AI BOM
SBOM-equivalent for AI: models, datasets, dependencies, licenses.
The problem
Customers ask "what model, what training data, what licenses?" Today you answer in a Google Doc. That breaks at ten models and fifty datasets — and a non-commercial dataset license can quietly poison a paid product.
What it does
Paste a package.json, requirements.txt, or a { models, datasets } manifest and get a CycloneDX-flavored Bill of Materials back — normalized components with a license-risk verdict per item and commercial-use conflict detection. Downloadable as JSON.
Capabilities
- CycloneDX-flavored component inventory (JSON export)
- Parses package.json, requirements.txt, or an AI manifest
- Per-component license risk: ok / review / conflict / unknown
- Flags non-commercial, copyleft, and community-license traps
- Runs in the browser or as an npm package / CI gate
How you run it
Paste a manifest in the browser and download the CycloneDX JSON. Subscribers can install @playciso/aibom and fail CI on any license conflict.
Roadmap
- Manifest parsing (npm / pip / AI manifest)
- License-conflict detection
- In-browser build + JSON export
- npm package + CI gate
- Live registry walkers (MLflow / HF)
AI BOM runs inside PlayCISO for subscribers. The source stays private — no public repos, nothing to fork, nothing for attackers to study. Weekly, monthly, and yearly plans all include every tool.