AI supply chain decision brief / 01 September 2026
Five AIBOM Tools Compared
Cisco AI BOM, Trusera ai-bom, AIBoMGen CLI, OWASP AIBOM Generator and Mend AI-BOM solve different parts of the inventory problem. This page compares the same six evidence axes without turning unlike products into a false league table.
The short answer
Choose the inventory job before the AIBOM tool
An AI bill of materials is the artifact. A repository scanner, a model-record generator and an enterprise governance platform are tools that may create, enrich or manage that artifact. Cisco AI BOM and Trusera ai-bom emphasize broad source-visible discovery. AIBoMGen CLI and OWASP AIBOM Generator are strongest where the subject is a Hugging Face model. Mend AI-BOM turns completed repository scans into organization, application or project reports inside a commercial platform.
When the inventory problem spans source code, model hubs, registries and CI controls, Pharos Production approaches it as scoped AI supply chain engineering: define the assets and evidence boundary first, then test whether a generator, discovery scanner or governed platform can produce the required record. That sequence prevents a polished export from hiding an incomplete discovery surface.
not public correctly. It means the reviewed official sources did not establish the capability. It does not prove that the feature is absent from a paid tier, roadmap or undocumented interface.Artifact anatomy
What a useful AIBOM needs to represent
A useful AIBOM, also called an AI SBOM or ML-BOM in parts of the market, links the AI system to the components and evidence that determine its behavior. A flat package list is not enough.
- Identity
- Model or service name, version, immutable digest, supplier, source, release time and owner.
- Model evidence
- Architecture, intended use, limitations, metrics, serialization format, weights, model provenance and fine-tune lineage.
- Dataset evidence
- Training and evaluation relationships, origin, license, collection, preprocessing, known bias and access terms.
- Application graph
- Frameworks, packages, prompts, agents, tools, MCP clients and servers, APIs, guardrails, deployment services and shadow AI found outside approved inventories.
- Assurance
- Hashes, signatures, claims, attestations, vulnerability records, review state, approval policy and last verification time.
- Lifecycle
- Build, deployment, runtime discovery, change history, replacement, incident lookup and decommissioning.
Coverage map
AIBOM coverage is a chain, not a single scan
Same-axis comparison
AIBOM tool evidence matrix
The matrix records public documentation, not laboratory performance. Documented confirms a current source says the capability exists. It does not measure recall, false positives, scale, latency or support quality.
| Tool | Discovery | AI coverage | Outputs | Provenance | CI/CD | Policy |
|---|---|---|---|---|---|---|
| AIBoMGen CLI | PartialRepo scan for Hugging Face references | PartialModels and datasets | DocumentedCycloneDX JSON/XML and SBOM merge | PartialHub metadata and completeness | DocumentedCompanion GitHub Action | PartialStrict completeness gate |
| Cisco AI BOM | DocumentedSource, container and cloud | DocumentedModels, data, agents, prompts, MCP | DocumentedTerminal, JSON and CSV documented | PartialSource mapping, no signed claim found | PartialScriptable CLI | PartialNo general policy engine established |
| Mend AI-BOM | DocumentedRepository scan snapshots | DocumentedModels plus entitled agent entities | DocumentedCycloneDX 1.7 or SPDX 3.0.1 JSON | PartialHashes, metadata and detection evidence | DocumentedCLI, integrations and report API | DocumentedTriage, suppression and audit trail |
| OWASP AIBOM Generator | PartialSelected Hugging Face model | PartialModel metadata and dependencies | DocumentedCycloneDX JSON download | PartialCompleteness and missing fields | Not publicNo supported CI path established | Not publicNo enforcement workflow established |
| Trusera ai-bom | Documented13 source-visible scanner classes | DocumentedModels, agents, MCP, cloud and workflows | DocumentedCycloneDX, SPDX, SARIF and six more | PartialFindings and risk properties | DocumentedGitHub and GitLab workflows | DocumentedThreshold and Cedar policy gates |
Tool profiles
Five products, five operating boundaries
Open-source Go CLI / AGPL-3.0
AIBoMGen CLI
Version v0.2.1. Maintained by IDLab, Ghent University and imec.
Documented fit
Generate a CycloneDX AI/ML BOM for Hugging Face models referenced in a repository, inspect completeness, enrich missing fields, import hub security-scan results and merge the result with a separate SBOM.
Operating constraint
The scanner is centered on Hugging Face model and dataset usage. Its breadth should not be inferred to cover general cloud AI services, arbitrary agents, prompts or MCP topology.
Disqualifier
Remove it from the primary shortlist when unmanaged agent or runtime discovery is the first job.
Official repository and CLI documentation ↗Open-source Python CLI / Apache-2.0
Cisco AI BOM
Version 1.10.0, released 17 August 2026.
Documented fit
Discover AI assets across polyglot source code, container images and cloud environments. The documented inventory includes models, agents, tools, MCP servers and clients, datasets, prompts, guardrails and secrets.
Operating constraint
The documented agentic classifier requires an LLM model and provider integration. Treat deterministic discovery and LLM-enriched classification as separate evaluation paths with separate data handling reviews.
Disqualifier
Remove it if policy forbids the required model call and the deterministic path alone does not meet recall.
Official repository and release documentation ↗Commercial platform / entitlement required
Mend AI-BOM
AI-BOM report released 24 August 2026.
Documented fit
Generate organization, application, project or label-scoped reports from completed Mend AI scans. Export CycloneDX 1.7 or SPDX 3.0.1 JSON through the platform or asynchronous API.
Operating constraint
Models are included by default, while prompts, agent configurations, agents, tools and MCP components depend on an eligible subscription. Framework libraries and vulnerability data are explicitly excluded from the AI-BOM report.
Disqualifier
Remove it when a fully local, account-free artifact is mandatory or a single export must include AI entities, libraries and vulnerabilities together.
Official AI-BOM report documentation ↗Open-source hosted tool / Apache-2.0
OWASP AIBOM Generator
Public Hugging Face Space, commit 6165ba9 at cutoff.
Documented fit
Create a human-readable and downloadable record for a selected Hugging Face model, inspect a field checklist and use completeness scoring to see which metadata or dependency evidence is missing.
Operating constraint
A public hosted workflow is not automatically suitable for confidential model identifiers, private repositories or regulated data. Validate the exact hosting and data retention boundary before using it with non-public assets.
Disqualifier
Remove it when the requirement is continuous repository discovery, enterprise RBAC, CI enforcement or a private deployment that has not been verified.
Official OWASP project page ↗Open-source Python CLI / Apache-2.0
Trusera ai-bom
Version v3.1.0; repository active at the cutoff.
Documented fit
Discover source-visible AI usage across code, model files, containers, cloud configuration, notebooks, workflows and MCP configuration, then export CycloneDX, SPDX, SARIF or operational report formats.
Operating constraint
The project states that it does not replace Trivy, Syft or Grype. Its AI discovery and policy output should be paired with traditional package, OS and vulnerability scanning rather than treated as a complete software supply chain control.
Disqualifier
Remove it as a standalone answer when the primary requirement is full training-data lineage or package vulnerability analysis.
Official repository and documentation ↗Interoperability
CycloneDX and SPDX support must be verified at field level
CycloneDX 1.7
The standard can represent a machine-learning-model component, model card, training and evaluation datasets, dependencies, formulation, claims, evidence and attestations. A tool carrying the CycloneDX label may still emit an older version or omit those optional structures.
SPDX 3.0.1
SPDX separates AI and Dataset profiles and uses explicit relationships for training, testing, licensing and provenance. An SPDX-shaped JSON file is not automatically conformant with the AI and Dataset profile requirements.
The Pharos Production AI supply chain security guide makes the operational point: model name alone is weak incident evidence. Source, immutable hash, license, serialization format and provenance turn a model-poisoning disclosure into a lookup instead of a manual investigation. The tool evaluation must therefore inspect populated fields, not just the format badge.
Proof of concept
Eight AIBOM acceptance tests to run on your own system
- Identity test. Change only a model revision or digest. The inventory must produce a distinct, traceable component identity without collapsing both revisions.
- Dataset test. Replace a fine-tuning or evaluation dataset. The AIBOM must expose the changed relationship, dataset license and missing provenance fields.
- Agent graph test. Add an agent tool or MCP server through configuration rather than a package manifest. Check whether discovery finds the connection and records direction.
- Opaque API test. Call a hosted model through an alias. Record whether the tool distinguishes provider, endpoint, model family, actual version and unresolved identity.
- Artifact test. Add a model file in Pickle and a safe serialization format. Check hashes, file type, source, scanner evidence and policy behavior.
- Completeness test. Remove license, intended use and training-data fields. The tool must preserve unknowns rather than silently implying a complete record.
- Pipeline test. Change a component after the last successful scan. Verify the CI gate, stale-snapshot behavior, report generation time and failure signal.
- Round-trip test. Export CycloneDX or SPDX, validate it with an independent parser and import it into the downstream inventory or GRC system that will consume it.
Selection logic
Shortlist two tools by failure mode, not feature count
If unmanaged source usage is the risk
Start with Cisco AI BOM and Trusera ai-bom. Compare language coverage, deterministic versus LLM enrichment, agent and MCP recall, cloud boundaries and the quality of source evidence.
If model-hub intake is the risk
Start with AIBoMGen CLI and OWASP AIBOM Generator. Compare private-model handling, CycloneDX versions, field completeness, security-scan evidence and how a human supplies missing provenance.
If audit workflow is the risk
Start with Mend AI-BOM and the strongest open generator for your codebase. Compare the managed report and API against an independently generated artifact to expose inventory gaps and platform lock-in.
If enforcement is the risk
Start with Trusera ai-bom and Mend AI-BOM. Test whether CI or governance policy can block the exact unapproved model, provider, prompt, tool or MCP condition your threat model names.
Buyer diligence
Questions that expose an AIBOM demo gap
What exactly is discovered?
Ask for the list of source languages, package manifests, model formats, hubs, cloud services, agent frameworks, prompt locations, MCP configurations, containers and runtime sources. The phrase AI inventory is too broad to be testable.
What is inferred?
Separate deterministic identifiers from regex matches, heuristics and LLM classification. Require confidence, source location and a review path for every inferred asset.
What can the export omit?
Ask for empty-field behavior, supported CycloneDX or SPDX version, profile conformance, relationship semantics and whether missing data is explicit.
How is the record kept current?
Identify scan triggers, snapshot freshness, drift detection, failed-scan behavior, report latency and the owner of manual fields.
Where do prompts and private metadata go?
Inspect upload boundaries, hashing, redaction, telemetry, retention, model-provider calls and whether a local-only mode is real.
Can the policy gate fail safely?
Test unavailable APIs, parser errors, stale inventory, uncertain identity and policy engine downtime. Decide whether each condition blocks, warns or disappears.
Implementation
A 30-day AIBOM evaluation sequence
- Days 1-3
Define the system boundary
Name repositories, model hubs, services, datasets, agents, tools, environments and consumers. Write three incidents the inventory must answer.
- Days 4-8
Freeze a representative fixture
Include one public model, one private alias, one dataset relation, one model file, one agent tool, one MCP server and deliberate missing metadata.
- Days 9-15
Run two candidates
Preserve raw commands, tool versions, configuration, output hashes, elapsed time and reviewer corrections. Do not compare screenshots.
- Days 16-21
Validate downstream use
Parse the export independently, import it into the intended consumer, run an incident lookup and test the required policy failure.
- Days 22-27
Measure maintenance
Change a model, dataset and tool. Record drift visibility, stale-state behavior, manual work and which evidence survives the update.
- Days 28-30
Write the decision record
Choose by the stated system boundary and failure modes. Record rejected candidates, open evidence gaps, renewal triggers and the next verification date.
E-E-A-T and limits
Who prepared this comparison and what it does not prove
Authorship and review
Prepared by Dmytro Nasyrov, Founder and CTO, for the Pharos Production engineering publication. AI-assisted drafting was used for source organization and prose preparation. The sources and data contract were checked against official repositories and documentation on 1 September 2026.
Independent technical review was not performed. Product maintainers and vendors did not approve this comparison.
Conflict disclosure
The publisher provides software engineering and cybersecurity services and may work with teams evaluating AI supply chain controls. No compared vendor paid for inclusion, supplied a ranking or received editorial control. The publisher is the evaluator, not a ranked alternative.
Correction policy: report a factual error with the source URL, product version and disputed statement to hello@pharosproduction.com. Material corrections will update the changelog and research date.
FAQ
AIBOM tool questions answered
What is an AIBOM?
An AIBOM is a machine-readable inventory of AI system components and relationships. A defensible record can include models, weights, datasets, software, hosted services, prompts, agents, tools, MCP connections, licenses, hashes, provenance and known gaps.
How is an AIBOM different from an SBOM?
An SBOM focuses on software packages and dependencies. An AIBOM adds AI-specific artifacts and context: model identity, training or evaluation datasets, intended use, limitations, model card fields, fine-tunes and AI service relationships. The two should connect rather than replace each other.
Is AI SBOM different from ML-BOM?
The market uses AIBOM, AI SBOM and ML-BOM inconsistently. CycloneDX uses ML-BOM for its machine-learning capability. Buyers should inspect component types, relationships and populated evidence rather than rely on the label.
Which AIBOM tool is the overall winner?
There is no overall winner in this comparison. A single-model generator, a broad source scanner and a managed governance platform solve different jobs. Choose the tool that passes acceptance tests for your system boundary.
Do AIBOM tools prove EU AI Act compliance?
No. An inventory can support technical documentation, supply chain transparency and incident response. It cannot by itself determine legal role, risk classification, conformity, data governance, human oversight or every documentation duty. Obtain legal advice for legal conclusions.
Should an AIBOM contain vulnerability data?
It may reference vulnerabilities or connect to a VDR, VEX or security platform, but tools differ. Mend explicitly excludes vulnerability data from its current AI-BOM report, while AIBoMGen CLI can inject selected Hugging Face security-scan findings. Test the exact downstream requirement.