AIROM is an open-source AI Bill of Materials (AIBOM) scanner. Point it at a directory, a Git repository, a container image, or a set of Kubernetes manifests. It inventories the AI assets it finds there: the models you call, the weights on disk, the frameworks and SDKs you import, the vector databases, the prompts, the datasets, and the serving infrastructure. It is a single static Go binary. No agent, no runtime hooks, no telemetry.

​
Evidence first

Most inventory tools hand you a list and ask you to trust it. When your AIBOM says gpt-4.1, you should be able to find out where that came from and which rule decided it. AIROM records that for every component it emits. Each one carries four fields: Every row in the table traces back to a line of source. A finding you cannot audit is a finding you cannot act on.
AIROM is the AI-asset counterpart to software-dependency scanning. The output is an AIBOM, and the unit of trust is the evidence attached to each component.

​
What it emits

AIROM writes CycloneDX 1.6 or 1.7 ML-BOM and carries the evidence through into evidence.occurrences[]. File and line provenance survives into the document itself rather than being discarded at serialization time. AIROM also emits SARIF, so the same findings render as annotations in a code-review UI. json, yaml, and a human table round out the formats. Any of them can be combined in a single pass with a repeatable -o.
One scan, two documents

​
What it inventories

Thirteen component kinds, each modelled explicitly rather than lumped into a generic “dependency”:

Models

hosted-llm (API model refs), local-model-file (weights on disk or in an image), embedding-model

Code

framework (langchain, transformers, vllm), library (openai, anthropic SDKs), application (the scan root)

Data

vector-db, dataset, prompt, rag-pipeline

Runtime

infra (ollama, vllm, tgi), service (remote endpoints), ai-config (unbound generation params)

​
Findings are not failures

A scan that finds 40 AI components exits 0. AIROM reports; it does not editorialize about what belongs in your codebase. When you want CI to fail, say so explicitly with --fail-on and a policy expression:
Fail only on high-confidence hosted models
AIROM is early software. Expect rough edges.Two source modes are not implemented yet. Live registry and daemon image pulls are unavailable, so pass a saved archive with image --input <tarball>. Live-cluster scanning is unavailable, so pass manifests with k8s --manifests <dir>. Both flags report the limitation in their own --help.

​
Next

Quickstart

Install and run your first scan in under two minutes.

What an AIBOM is

The document model, and why AI assets need their own bill of materials.

Scan a filesystem

Directory trees, ignore rules, and size budgets.

CLI reference

Every command, every flag, every exit code.