cnspec aibom

Use cnspec aibom to generate an AI bill of materials (AIBOM) that inventories the AI and ML models in use across cloud providers, model registries, inference APIs, and local runtimes. An AIBOM gives you a clear picture of which models your organization runs and where, so you can govern and secure your AI supply chain.

The following providers have their own subcommand, such as cnspec aibom ollama:

• local: Local system (agents, cached models)
• ollama: Ollama models
• huggingface: Hugging Face Hub models
• aws: AWS Bedrock and SageMaker
• gcp: GCP Vertex AI and Model Armor
• azure: Azure AI Services (OpenAI, Cognitive Services)

You can also run cnspec aibom on a container image, a Docker container, a mounted file system, or a remote host over SSH, WinRM, or Vagrant, with the container, docker, filesystem, ssh, winrm, and vagrant subcommands.

These providers have no subcommand. To include them, define the asset and its credentials in an inventory file and pass it with --inventory-file, as shown below:

• openai: OpenAI API (models, vector stores, fine tuning)
• claude: Anthropic Claude API (models, agents, skills)
• vllm: vLLM inference server

The following output formats are supported:

• markdown (default)
• json
• cyclonedx-json
• cyclonedx-xml

cnspec checks the output format before it scans, and exits with an error if you pass a format it doesn't support.

Generate an AIBOM for your local system:

cnspec aibom local

Generate an AIBOM for your local system as JSON:

cnspec aibom local -o json

Generate an AIBOM for an Ollama instance in CycloneDX JSON format:

cnspec aibom ollama -o cyclonedx-json

Generate an AIBOM for an AWS account in CycloneDX JSON format:

cnspec aibom aws -o cyclonedx-json

To generate AIBOMs for the assets in an inventory file, using the credentials it defines, pass --inventory-file instead of a provider subcommand:

cnspec aibom --inventory-file inventory.yml -o json --output-target aibom.json

An inventory with several assets produces one AIBOM per asset. With --output-target, cnspec writes each AIBOM to its own file, inserting the asset's index before the extension (aibom-0.json, aibom-1.json, and so on), in order of asset name. Assets that cnspec can't scan get no AIBOM. cnspec lists them and exits with status 1 after it writes the others.

OptionsCopy Anchor Link

      --annotation stringToString     Add an annotation to the asset in the form KEY=VALUE (default [])
      --asset-name string             User-override for the asset name
      --discover strings              Enable the discovery of nested assets. Supports: all, auto, container, container-images, mcp-servers
  -h, --help                          help for aibom
      --inventory-file string         Set the path to the inventory file. With several assets, --output-target gets one file per asset
      --inventory-format-ansible      Set the inventory format to Ansible
      --inventory-format-domainlist   Set the inventory format to domain list
  -o, --output string                 Set output format: markdown, json, cyclonedx-json, cyclonedx-xml (default "markdown")
      --output-target string          Set output target to which the AIBOM report will be written
      --record string                 Record all resource calls and use resources in the recording
      --sudo                          Elevate privileges with sudo
      --use-recording string          Use a recording to inject resource data (read-only)

Options inherited from parent commandsCopy Anchor Link

      --api-proxy string        Set the proxy for communications with Mondoo Platform API
      --auto-update             Enable automatic updates of cnspec and its providers; overrides auto_update in the config file (default true)
      --config string           Set config file path (default $HOME/.config/mondoo/mondoo.yml)
      --log-level string        Set the log level: error, warn, info, debug, trace (default "info")
      --logging-config string   Path to a logging configuration file (YAML or JSON) that selects the log writer, level, and writer-specific options
      --strict                  Default MQL strict mode for policies that do not declare one: every link in an MQL chain must resolve
  -v, --verbose                 Enable verbose output

SEE ALSOCopy Anchor Link

• cnspec - cnspec CLI