What Is an AI-BOM and Why Your Agent Stack Needs One
An AI Bill of Materials is a machine-readable inventory of every component in your agent stack. Here's why compliance auditors are starting to ask for one.
TL;DR
- An AI-BOM (AI Bill of Materials) is a machine-readable inventory of every component in your agent stack
- Compliance frameworks (EU AI Act, SOC2) are starting to require it
- CycloneDX 1.7 is the emerging standard - Firmis generates it automatically
- You can't secure what you can't see. The BOM makes your agent stack visible.
What is an AI-BOM?
A Software Bill of Materials (SBOM) lists every library in your app. An AI-BOM extends this to your agent stack: which MCP servers, which skills, which models, which tools, which permissions.
It's the foundation for auditing agent security. You can't protect what you can't inventory.
Why It Matters Now
Compliance frameworks are catching up to AI agents. The first question auditors ask: "What AI tools are you running?" If you can't answer precisely, you have a compliance gap.
What Goes in an AI-BOM
Agent platforms
OpenClaw, MCP, Claude, etc.
Installed tools
Version + source + publisher
Permissions
What each tool can access
Model files
Provenance + format
Dependencies
npm, pip packages
Configs
File locations + settings
CycloneDX 1.7: The Standard
CycloneDX is the industry standard for SBOMs. Version 1.7 added AI/ML component types. Firmis generates CycloneDX 1.7 AI-BOMs with a firmis:agent:* property namespace - machine-readable, auditor-friendly, standards-compliant.
Generate Your First AI-BOM
From Inventory to Action
You can't secure what you can't see. An AI-BOM makes your agent stack visible.
Try It Now
Find out if your agent stack is safe
One command. 30 seconds. Free.
Fix and Monitor included with Pro
View pricing