Log inGet a free assessment

AI Bill of Materials

Know the AI in your code,
before it ships.

xgrep inventories every AI building block in your code and emits a CycloneDX 1.6 AI Bill of Materials (AIBOM): the model providers it calls, the agent frameworks it is built on, the inference runtimes it embeds, and the models it requests. It is the inventory AI governance starts from, produced fully offline from a single binary.

Read the docsExplore xgrep
Bash
$ xgrep sbom --include aibom .


  provider   openai          src/agents/chat.py:12    gpt-4o
  framework  langchain       src/agents/graph.py:3
  inference  ollama          src/local/run.py:27      llama3.1
  model      claude-3-5-sonnet  src/review/llm.py:44


  CycloneDX 1.6 AIBOM · run `xgrep sbom --include aibom --output aibom.cdx.json .` to save it

You can’t govern AI you can’t see.

AI has entered your codebase faster than anyone approved it: a provider SDK here, an agent framework there, a model name hard-coded in a prompt. Governing it, from the EU AI Act to your own model and data-residency policy, starts with knowing what is actually there. An AIBOM is that inventory.

Find the shadow AI

Surveys and manifests miss the AI that teams wired in directly. xgrep reads the code itself, so a provider SDK or a local model that no one declared still shows up in the inventory, with the file and line that uses it.

Answer the governance questions

Which models do we call, and whose? Where does prompt data leave the building? A machine-readable AIBOM feeds AI risk programs such as the NIST AI Risk Management Framework and your EU AI Act obligations with evidence instead of a spreadsheet.

An inventory, not a findings list.

An AIBOM maps what you use, it does not flag it as a problem. A sanctioned model in approved code is listed as an asset, so you get a complete picture rather than a pile of alerts to triage.

What the code uses
Detection is import and usage based, so the AIBOM reflects the AI a codebase actually imports and calls, not what a manifest merely declares. A version and package URL are attached when a manifest pins the library.
Zero finding noise
AI-inventory detection is its own rule category, off in a normal scan. Your security rules keep reporting vulnerabilities in xgrep scan exactly as before.
Models captured by name
Where the code names a model, xgrep captures it, even when it comes from a constant, a default, or a ternary, so gpt-4o and claude-3-5-sonnet land in the inventory as their own components.

Every layer of the AI stack.

xgrep recognizes AI across the whole stack, from the API you call to the model you name, and records each as a typed component in the bill of materials.

Providers
Hosted LLM API SDKs your code calls
OpenAI, Anthropic, Cohere, AWS Bedrock, watsonx
Frameworks
Orchestration and agent frameworks
LangChain, LlamaIndex, Spring AI, Vercel AI SDK, Semantic Kernel
Inference runtimes
Local and self-hosted model runtimes
Ollama, llama.cpp, Hugging Face Transformers, ONNX Runtime
Models
The specific models requested in code
gpt-4o, claude-3-5-sonnet, gemini-1.5-pro
Vector stores
RAG vector-database clients
Pinecone, Chroma, Qdrant, Milvus, Weaviate, pgvector
Guardrails & eval
Safety, observability and evaluation tooling
NeMo Guardrails, LLM Guard, Langfuse, Ragas, DeepEval

Standards-based, across 20 languages.

xgrep emits the AIBOM as a CycloneDX 1.6 ML-BOM (or 1.7 with --spec-version 1.7), so it conforms to the official schema and drops straight into the broader AI-governance and SBOM ecosystem.

AI-library detection ships for 20 languages, matched on the real import or call, so look-alike names that merely share a prefix are rejected:

PythonJavaScript/TypeScriptJavaKotlinScalaGoC#RustRubyPHPDartSwiftElixirRJuliaC/C++BashGroovyLuaPowerShell

Learn more about the format in the CycloneDX ML-BOM specification.

Generate an AIBOM.

One command, no build and no network. It runs anywhere xgrep runs, including CI, straight from a single binary.

Inventory the AI in your code and save the AIBOM
Bash
# Print the AI inventory
xgrep sbom --include aibom .


# Write a CycloneDX 1.6 AIBOM to a file
xgrep sbom --include aibom --output aibom.cdx.json .


# Merge the AI inventory with your dependencies in one document
xgrep sbom --include sca,aibom .
Bash
# Run it with npx, no install required
npx @mondoohq/xgrep sbom --include aibom .