discover-ai-bom

Builds a deterministic AI BOM from a point-in-time inventory snapshot. The result is a JSON document that is easy to diff, archive, and feed into agent workflows, audit evidence pipelines, or future sink skills.

Use when

• You need a portable inventory of AI systems, models, endpoints, datasets, vector stores, runtimes, and guardrails
• You want one artifact that can support AI security reviews, PCI / SOC 2 technical evidence, or internal architecture reviews
• You already have inventory exported from AWS, GCP, Azure, or a normalized collector and need to normalize it
• You want to capture AI estate drift over time using deterministic output

Do NOT use

• On raw logs, findings, or event streams — this is inventory, not telemetry
• To infer exploitability or benchmark pass/fail by itself
• As a live control plane or remediation trigger
• To include secrets, tokens, or connection strings in the BOM