What is an AI-BOM (AI bill of materials)?
ANSWER FIRST
An AI-BOM is an inventory of the AI components in your software and development environment: models referenced in code, AI packages, assistant rule files, MCP servers and AI API keys. It does for AI what an SBOM does for open source dependencies: it tells you what is there, where, and who added it.
Editorial assessment · Compiled from vendor product, docs, pricing and marketplace pages · Rated October 2026
What goes into an AI-BOM?
- Model references and AI API endpoints.
- AI packages and SDKs.
- Assistant rule files such as .cursorrules and .windsurfrules.
- MCP server connections.
- AI API keys.
Cycode's AI-BOM tracks each of these with provenance: who committed it, in which repository and branch, and when.
Source: cycode.com/ai/ · Reviewed Sep 2026
How is an AI-BOM different from an SBOM?
An SBOM lists software components and their versions. An AI-BOM lists AI-specific components, including items that are not packages at all, such as rule files and MCP server configurations, which shape what an assistant does.
Which tools produce an AI-BOM or AI inventory?
- Cycode: AI-BOM with commit provenance.
Source: cycode.com/ai/ · Reviewed Sep 2026
- Apiiro: AI-BOM discovery.
Source: apiiro.com · Reviewed Sep 2026
- OX Security: AI inventory in VibeSec.
Source: docs.ox.security/llms.txt · Reviewed Sep 2026
- Legit Security: discovery of assistants, models and MCP servers in VibeGuard.
Source: legitsecurity.com/security-governance-for-ai-generated-code-legit-vibeguard · Reviewed Sep 2026
- Endor Labs: AURI inventory of agents, models, MCP servers and skills.
Source: endorlabs.com · Reviewed Sep 2026
Frequently asked questions
Why do I need an AI-BOM?
To know which models, assistants and MCP servers touch your code, so you can set policy, respond to a vulnerable component and answer audit questions.