How trusera/ai-bom works
AI-BOM inventories AI agents, models, APIs, and related infrastructure, then risk-scores findings for reporting, policy checks, or API consumption. Its principal workflow is a user or automation invoking a scan, discovery scanners inspecting the target, and results being summarized and emitted in a selected format. The repository also includes runtime monitoring SDKs, a VS Code extension, n8n nodes, and platform-facing dashboard/API capabilities. Unsampled subsystems are represented at their existing directory paths; relationships without source evidence are omitted.
Main entry points: cli.py CLI · scanners Discovery scanners · nodes n8n nodes · models.py Inventory models
Components 23
Discovery and scanning
- Discovery scanners
src/ai_bom/scanners - Code detection
src/ai_bom/detectors/llm_patterns.py
Analysis and compliance
- Inventory models
src/ai_bom/models.py - Risk scoring
src/ai_bom/utils/risk_scorer.py - LLM enrichment
src/ai_bom/enrichment/llm_enricher.py - Compliance checks
src/ai_bom/compliance - Scan policy
src/ai_bom/policy.py
Results and interfaces
- CLI
src/ai_bom/cli.py - Report formats
src/ai_bom/reporters - REST API
src/ai_bom/server.py - Dashboard
src/ai_bom/dashboard - Callable models
src/ai_bom/callable
Runtime monitoring
- Python SDK
trusera-agent-sdk/trusera_sdk/interceptor.py - TypeScript SDK
trusera-sdk-js/src/interceptor.ts - Go SDK
trusera-sdk-go/interceptor.go - Event client
trusera-sdk-js/src/client.ts
Editor and workflow integrations
- VS Code extension
vscode-extension/src/extension.ts - n8n nodes
n8n-node/nodes - n8n scanner
n8n-node/lib/scanner.ts - n8n sidecar gate
n8n-node/lib/sidecar/policyGate.ts
Other components
- Engineer
- AI application
- Trusera platform
Connections 24
- Engineer → CLI: invokes scan
README.md - CLI → Discovery scanners: scans project
README.md - Discovery scanners → Code detection: detects patterns
src/ai_bom/detectors/llm_patterns.py - Discovery scanners → Inventory models: builds inventory
src/ai_bom/server.py - Discovery scanners → Risk scoring: scores findings
src/ai_bom/server.py - CLI → Report formats: selects output
README.md - CLI → Scan policy: checks thresholds
README.md - CLI → Compliance checks: supports compliance
README.md - CLI → LLM enrichment: optionally enriches
README.md - Engineer → REST API: requests scan
src/ai_bom/server.py - REST API → Discovery scanners: starts scan
src/ai_bom/server.py - Engineer → Dashboard: views inventory
README.md - Inventory models → Callable models: feeds callable models
README.md - AI application → Python SDK: installs interception
README.md - AI application → TypeScript SDK: installs interception
README.md - AI application → Go SDK: wraps HTTP client
README.md - Python SDK → Trusera platform: sends events
README.md - TypeScript SDK → Event client: records and flushes
trusera-sdk-js/src/client.ts - Event client → Trusera platform: posts event batches
trusera-sdk-js/src/client.ts - Engineer → VS Code extension: scans workspace
README.md - Engineer → n8n nodes: runs workflow nodes
README.md - n8n nodes → n8n scanner: scans workflows
n8n-node/nodes/TruseraWebhook/TruseraWebhook.node.ts - n8n nodes → n8n sidecar gate: evaluates tool calls
n8n-node/nodes/TruseraSidecarTool/TruseraSidecarTool.node.ts - n8n sidecar gate → Trusera platform: evaluates Cedar policies
n8n-node/lib/sidecar/policyGate.ts