Generate and analyze AI Bill of Materials (AIBOM) for Python projects to track AI models, datasets, and ML frameworks for security, compliance, and governance.
Core Principle: Know what AI components are in your software.
Note: This is an experimental feature. Currently supports Python projects only.
Quick Start
# Step 1: Generate AIBOM for the project
mcp_snyk_snyk_aibom(path="/absolute/path/to/project")
mcp_snyk_snyk_aibom( path="/absolute/path/to/project", json_file_output="/absolute/path/to/output/aibom.json" )
Step 3: Verify the returned JSON contains component entries before proceeding Step 4: Summarize findings and flag license/risk issues
---
## Prerequisites
- Python project with `requirements.txt`, `setup.py`, or `pyproject.toml`
- Internet connection (required for analysis)
- Snyk experimental features enabled
---
## Phase 1: Project Validation
**Goal**: Ensure the project is suitable for AI BOM generation.
### Step 1.1: Verify Python Project
Check for Python project indicators: `requirements.txt`, `setup.py`, `pyproject.toml`, `Pipfile`, or `.py` files.
> **Error — Not a Python Project**: If no Python indicators are found, stop and report:
> - Verify path contains Python files
> - Check for `requirements.txt` or `pyproject.toml`
> - This feature only supports Python projects
### Step 1.2: Check for AI/ML Indicators
Scan dependency files for known AI/ML packages — common examples include `torch`, `tensorflow`, `keras`, `transformers`, `datasets`, `scikit-learn`, `jax`, `openai`, `langchain`, `mlflow`, and `wandb`. This list is illustrative; use judgment for other AI/ML packages encountered.
### Step 1.3: Report if Not Applicable
If no AI components detected:
AI Inventory Result
Project: /path/to/project Status: No AI components detected This project does not appear to use AI/ML frameworks. AI BOM generation is not applicable.
---
## Phase 2: Generate AIBOM
**Goal**: Create comprehensive AI Bill of Materials.
### Step 2.1: Run AIBOM Generation
Invoke the `mcp_snyk_snyk_aibom` tool with the absolute path to the Python project:
mcp_snyk_snyk_aibom(path="/absolute/path/to/project")
> **Error — Network Error**: If the tool cannot connect, report:
> - Check internet connection and firewall (HTTPS must be allowed)
> - Retry after a few minutes
> **Error — Experimental Feature Not Enabled**: If access is denied, report:
> - Contact Snyk support for experimental access
> - Check organization settings and verify CLI version supports AIBOM
### Step 2.2: Validate AIBOM Output
Before proceeding, verify the returned JSON is valid and contains at least one component entry. If the response is empty or malformed, report the error and do not continue to Phase 3.
### Step 2.3: Save Output (Optional)
To persist the AIBOM as a file for documentation or downstream tooling:
mcp_snyk_snyk_aibom( path="/absolute/path/to/project", json_file_output="/absolute/path/to/output/aibom.json" )
---
## Phase 3: Analyze Components
**Goal**: Understand and categorize AI components from the validated AIBOM output.
### Step 3.1: Component Categories
AIBOM identifies five component types: **Models**, **Datasets**, **Frameworks**, **Tools**, and **Services**.
### Step 3.2: Generate Summary Report
Present findings using the structure below, populated with actual scan results:
AI Component Inventory
Project: Scan Date: Format: CycloneDX v1.6
Component Summary
| Category | Count |
|---|---|
| AI Models | N |
| Datasets | N |
| Frameworks | N |
| Tools | N |
| Total | N |
AI Models Detected
| Model | Source | License | Risk |
|---|---|---|---|
| ... | ... | ... |
Datasets Referenced
| Dataset | Source | License | PII Risk |
|---|---|---|---|
| ... | ... | ... |
Frameworks & Tools
| Component | Version | License |
|---|---|---|
| ... | ... |
---
## Phase 4: Risk Assessment
**Goal**: Identify potential risks in AI components.
### Step 4.1: License Compliance
Flag components by risk level: **Low** (MIT, Apache), **Medium** (proprietary APIs — review terms of service), **High** (unknown/unclear licenses or research-only terms that may prohibit commercial use).
### Step 4.2: Data Privacy Concerns
Flag datasets or models where data provenance or PII handling is unclear. Recommend: documenting data sources, reviewing PII handling procedures, and verifying data retention policies.
### Step 4.3: Model Security
Assess model-specific risks: prompt injection (LLM-based models — mitigate with input validation), model extraction (custom/fine-tuned models — apply access controls), adversarial inputs (vision models — input validation), and bias/fairness (consider bias testing).
---
## Phase 5: Documentation
**Goal**: Create compliance-ready documentation.
### Step 5.1: Generate Compliance Report
AI Compliance Report
Project: Generated: Standard: EU AI Act / Internal Governance
AI System Classification
- Risk Level: [High/Limited/Minimal]
- Category: [Classification based on use case]
Component Inventory
[Summary from Phase 3]
License Compliance
- All components licensed: Yes/No
- Commercial use permitted: Yes/No
- Attribution required: [list components]
Data Governance
- Data sources documented: Yes/No
- PII handling reviewed: Yes/No
- Consent verified: Yes/No
Model Governance
- Model cards available: Yes/No
- Bias testing completed: Yes/No
- Performance benchmarks: Yes/No
Approval Status
- Technical review
- Legal review
- Ethics review
- Deployment approved
---
## Use Cases
- **Pre-Deployment Audit**: Generate AIBOM → review licenses → check data/PII handling → document for audit trail
- **Regulatory Compliance (EU AI Act)**: Generate AIBOM → classify AI system risk level → document capabilities/limitations → create compliance checklist
- **Third-Party AI Review**: Generate AIBOM → analyze licenses → assess data handling → document risks and mitigations
---
## Constraints
1. **Python only**: Currently only supports Python projects
2. **Experimental**: Feature may change or have limitations
3. **Network required**: Needs internet for analysis
4. **CycloneDX output**: Generates CycloneDX v1.6 format only
5. **Point-in-time**: Reflects current state — regenerate on updates