AI SUPPLY-CHAIN ANALYSIS

Inspect a repository

Discover AI components, prioritize supply-chain risks, and trace every finding to file-and-line evidence.

Repository scan

1 Enter repository URLGitHub, GitLab, Bitbucket, or Codeberg
2 Run the scanFiles and advisories are inspected
3 Review the evidenceFindings, graph, inventory, and exports

Repository URL

What it scans: a two-file FastAPI + OpenAI Agents app shipped inside AIBOM Inspector as a test fixture — deliberately vulnerable, and never executed. An HTTP request body is concatenated into the agent's instructions, and that agent is bound to a tool that runs shell commands. No repository URL, API key, or internet access needed.

Static analysis only: files and manifests are read as text. Repository code is never run and model weights are never loaded. Package advisories come from OSV; every finding comes from a deterministic rule, not a model.

Analysis results

Waiting for input

READY

No analysis loaded

Enter a repository URL above and start the analysis. Findings and evidence will appear here.

SCAN RESULT

Repository

OVERVIEW

AI supply-chain score

–

/ 100

0findings

0AI components

0files inspected

How the score should be read

The score covers the supply-chain hygiene of detected AI components—not the overall security of the repository. Integrity, provenance, licensing, and configuration each start at 100 and lose points when a rule is triggered.

Critical, high, medium, and low findings deduct 40, 20, 10, and 3 points. The overall result weights both the category average and the weakest category, so a serious weakness is not hidden by stronger areas.

Grades: A ≥ 90 · B ≥ 75 · C ≥ 60 · D ≥ 40 · F < 40. Every deduction can be traced to a finding and its source evidence below.

Findings

Review the most severe items first. Search across rules, descriptions, remediation, entities, and source locations.

Severity	Rule	Finding and next step	Evidence

Trust-boundary and dependency context

The paths below show which tools a steered agent could reach, and how untrusted input gets to it. Prompt bodies are never retained.

critical high medium low no finding

Select a node to inspect its evidence and related findings.

Inventory

The complete bill of materials includes ordinary dependencies as well as AI-specific components.

Type	Name	Provider / source	Usage	Context	Evidence / detector

SBOM minimum elements

Conformance of the generated CycloneDX AIBOM with the CISA 2026 minimum elements, which apply to AI software as well. Data static analysis cannot know is declared as a known unknown rather than left blank.

Status	Element	Since	Coverage	CycloneDX field

Help and input formatsQuick guidance for running an analysis

Getting started

Paste a complete public repository URL.
Select Start analysis and keep the page open.
Review critical and high findings before lower severities.
Export the HTML report or CycloneDX file when needed.

Accepted inputs

GitHub: https://github.com/owner/repository
GitLab: https://gitlab.com/owner/repository
Bitbucket: https://bitbucket.org/owner/repository
Codeberg: https://codeberg.org/owner/repository