🤖 Discover the AI components hidden inside a software repository.
AI BOM Generator is an experimental, client-side application that analyzes GitHub repositories for AI and LLM usage. It identifies AI libraries, referenced models, code-level usage, infrastructure, hardware requirements, and governance documentation, then produces machine-readable AI Bill of Materials output.
The project was created to explore practical AI component discovery while AI BOM specifications and industry practices continue to evolve.
With AI BOM Generator, you can:
✅ Analyze a public GitHub repository for AI and machine-learning components
✅ Detect AI libraries across Python, Node.js, Go, Java, and Rust projects
✅ Identify referenced text-generation, embedding, and image-generation models
✅ Locate evidence using filenames, line numbers, and code snippets
✅ Detect cloud AI services such as Amazon Bedrock, SageMaker, Vertex AI, and Azure Machine Learning
✅ Identify Docker, Kubernetes, MLOps, GPU, TPU, CUDA, TensorRT, and OpenVINO usage
✅ Review model documentation, intended-use statements, limitations, and governance indicators
✅ Generate CycloneDX 1.7, SPDX 3.0.1, and an extended experimental AI BOM format
✅ Export results as JSON or XML
Why it stands out:
🔍 Combines dependency analysis with source-code evidence
📦 Treats models, libraries, infrastructure, and hardware as part of the AI supply chain
🔐 Runs in the browser and sends repository requests only to GitHub APIs
🧪 Provides a practical test bed for emerging AI BOM concepts
The tool requires a GitHub Personal Access Token to avoid restrictive unauthenticated API limits. For public repository analysis, a token without repository scopes can be used.
This project is experimental. Generated output may not fully conform to evolving AI BOM specifications and should be validated before use in compliance, procurement, or security decision-making.
Check it out: https://cyfinoid.github.io/aibommaker/
Source Code: https://github.com/cyfinoid/aibommaker