How to choose an AI BOM tool for your DevSecOps pipeline

Do you want to check model licenses, track vulnerable dependencies, or identify changes to the models in use? The fields and tools you need depend on your objective. Start by inventorying model IDs and versions, providers, software dependencies, where models are used, and who is responsible, adding datasets and licenses as needed.

CycloneDX's ML-BOM is a format that can represent models, datasets, and other information. However, a field's existence in the format does not mean a tool can retrieve its value from your environment.

cdxgen is a candidate for generating BOMs from sources such as source code. Dependency-Track accepts CycloneDX BOMs and can be used for submissions from CI/CD and component analysis. Generation by the former and ingestion and management by the latter serve different roles, so evaluate combinations as well.

Generation tools also differ in what they examine. AIBoMGen CLI generates a CycloneDX AI BOM for Hugging Face model usage within a repository, and a GitHub Action is also available. xgrep examines AI SDK and model usage in code offline and outputs the results in CycloneDX 1.6 format. However, xgrep's AI-specific output does not include general software dependencies, so a separate SBOM must be generated.

Even if you already use an SBOM generator, it may not capture model-specific information. Look for other candidates in the CycloneDX Tool Center, checking not just supported formats but also the model information fields they output, CLI and API capabilities, authentication, and your existing ticket workflows.

The following is an official example for cdxgen v13.6.0. Generate a BOM for a target that contains no confidential information, then check the model ID, version, and license against the original configuration. This is a command example, not the result of running it in this environment.

Datasets and base models listed in a model card are declarations by the provider. Do not treat them as proof of actual use in training; check the card's statements, observed dependencies, and training-job evidence separately.

cdxgen -r --include-formulation -o aibom.json --bom-audit --bom-audit-categories ai-bom .

Static analysis of a repository alone may miss models selected at runtime through environment variables or external APIs. If we were reviewing the code, we would cross-check the generated inventory against the application's configuration and usage records and investigate references missing from it. Code analysis alone does not necessarily reveal the full extent of external model usage.

Once you integrate the process into CI, change a model version and check whether the next artifact reflects the difference and whether the receiving system retains the required fields. Successfully running the generation command does not guarantee that CI will fail when an issue is detected. Configure failure conditions and exit-code handling separately, and establish a process that does not treat items awaiting manual review as passed.