# trusera/ai-bom architecture

> Architecture diagram of the GitHub repository trusera/ai-bom, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-13). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/trusera/ai-bom
- Repository: https://github.com/trusera/ai-bom

## Overview

AI-BOM inventories AI agents, models, APIs, and related infrastructure, then risk-scores findings for reporting, policy checks, or API consumption. Its principal workflow is a user or automation invoking a scan, discovery scanners inspecting the target, and results being summarized and emitted in a selected format. The repository also includes runtime monitoring SDKs, a VS Code extension, n8n nodes, and platform-facing dashboard/API capabilities. Unsampled subsystems are represented at their existing directory paths; relationships without source evidence are omitted.

Main entry points: [`src/ai_bom/cli.py`](https://github.com/trusera/ai-bom/blob/main/src/ai_bom/cli.py) (CLI), [`src/ai_bom/scanners`](https://github.com/trusera/ai-bom/tree/main/src/ai_bom/scanners) (Discovery scanners), [`n8n-node/nodes`](https://github.com/trusera/ai-bom/tree/main/n8n-node/nodes) (n8n nodes), [`src/ai_bom/models.py`](https://github.com/trusera/ai-bom/blob/main/src/ai_bom/models.py) (Inventory models)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_discovery["Discovery and scanning"]
  node_scanners["Discovery scanners"]
  node_codepatterns["Code detection<br/>[llm_patterns.py]"]
end

subgraph group_analysis["Analysis and compliance"]
  node_models["Inventory models<br/>[models.py]"]
  node_risk["Risk scoring<br/>[risk_scorer.py]"]
  node_enrichment["LLM enrichment<br/>[llm_enricher.py]"]
  node_compliance["Compliance checks"]
  node_policy["Scan policy<br/>[policy.py]"]
end

subgraph group_delivery["Results and interfaces"]
  node_cli["CLI<br/>[cli.py]"]
  node_reporters["Report formats"]
  node_api["REST API<br/>[server.py]"]
  node_dashboard["Dashboard"]
  node_callable["Callable models"]
end

subgraph group_runtime["Runtime monitoring"]
  node_python_sdk["Python SDK<br/>[interceptor.py]"]
  node_js_sdk["TypeScript SDK<br/>[interceptor.ts]"]
  node_go_sdk["Go SDK<br/>[interceptor.go]"]
  node_events["Event client<br/>[client.ts]"]
end

subgraph group_integrations["Editor and workflow integrations"]
  node_vscode["VS Code extension<br/>[extension.ts]"]
  node_n8n["n8n nodes"]
  node_n8n_scan["n8n scanner<br/>[scanner.ts]"]
  node_n8n_sidecar["n8n sidecar gate<br/>[policyGate.ts]"]
end

node_user(("Engineer"))
node_agent(("AI application"))
node_platform["Trusera platform"]

node_user -->|"invokes scan"| node_cli
node_cli -->|"scans project"| node_scanners
node_scanners -->|"detects patterns"| node_codepatterns
node_scanners -->|"builds inventory"| node_models
node_scanners -->|"scores findings"| node_risk
node_cli -->|"selects output"| node_reporters
node_cli -->|"checks thresholds"| node_policy
node_cli -->|"supports compliance"| node_compliance
node_cli -.->|"optionally enriches"| node_enrichment
node_user -->|"requests scan"| node_api
node_api -->|"starts scan"| node_scanners
node_user -.->|"views inventory"| node_dashboard
node_models -->|"feeds callable models"| node_callable
node_agent -->|"installs interception"| node_python_sdk
node_agent -->|"installs interception"| node_js_sdk
node_agent -->|"wraps HTTP client"| node_go_sdk
node_python_sdk -->|"sends events"| node_platform
node_js_sdk -->|"records and flushes"| node_events
node_events -->|"posts event batches"| node_platform
node_user -->|"scans workspace"| node_vscode
node_user -->|"runs workflow nodes"| node_n8n
node_n8n -->|"scans workflows"| node_n8n_scan
node_n8n -->|"evaluates tool calls"| node_n8n_sidecar
node_n8n_sidecar -->|"evaluates Cedar policies"| node_platform

click node_cli "https://github.com/trusera/ai-bom/blob/main/src/ai_bom/cli.py"
click node_scanners "https://github.com/trusera/ai-bom/tree/main/src/ai_bom/scanners"
click node_codepatterns "https://github.com/trusera/ai-bom/blob/main/src/ai_bom/detectors/llm_patterns.py"
click node_models "https://github.com/trusera/ai-bom/blob/main/src/ai_bom/models.py"
click node_risk "https://github.com/trusera/ai-bom/blob/main/src/ai_bom/utils/risk_scorer.py"
click node_enrichment "https://github.com/trusera/ai-bom/blob/main/src/ai_bom/enrichment/llm_enricher.py"
click node_compliance "https://github.com/trusera/ai-bom/tree/main/src/ai_bom/compliance"
click node_policy "https://github.com/trusera/ai-bom/blob/main/src/ai_bom/policy.py"
click node_reporters "https://github.com/trusera/ai-bom/tree/main/src/ai_bom/reporters"
click node_api "https://github.com/trusera/ai-bom/blob/main/src/ai_bom/server.py"
click node_dashboard "https://github.com/trusera/ai-bom/tree/main/src/ai_bom/dashboard"
click node_callable "https://github.com/trusera/ai-bom/tree/main/src/ai_bom/callable"
click node_python_sdk "https://github.com/trusera/ai-bom/blob/main/trusera-agent-sdk/trusera_sdk/interceptor.py"
click node_js_sdk "https://github.com/trusera/ai-bom/blob/main/trusera-sdk-js/src/interceptor.ts"
click node_go_sdk "https://github.com/trusera/ai-bom/blob/main/trusera-sdk-go/interceptor.go"
click node_events "https://github.com/trusera/ai-bom/blob/main/trusera-sdk-js/src/client.ts"
click node_vscode "https://github.com/trusera/ai-bom/blob/main/vscode-extension/src/extension.ts"
click node_n8n "https://github.com/trusera/ai-bom/tree/main/n8n-node/nodes"
click node_n8n_scan "https://github.com/trusera/ai-bom/blob/main/n8n-node/lib/scanner.ts"
click node_n8n_sidecar "https://github.com/trusera/ai-bom/blob/main/n8n-node/lib/sidecar/policyGate.ts"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_scanners,node_codepatterns,node_platform toneBlue
class node_models,node_risk,node_enrichment,node_compliance,node_policy toneAmber
class node_cli,node_reporters,node_api,node_dashboard,node_callable toneMint
class node_python_sdk,node_js_sdk,node_go_sdk,node_events toneRose
class node_vscode,node_n8n,node_n8n_scan,node_n8n_sidecar,node_user,node_agent toneIndigo
```

## Components

### Discovery and scanning

- [Discovery scanners](https://github.com/trusera/ai-bom/tree/main/src/ai_bom/scanners): `src/ai_bom/scanners`
- [Code detection](https://github.com/trusera/ai-bom/blob/main/src/ai_bom/detectors/llm_patterns.py): `src/ai_bom/detectors/llm_patterns.py`

### Analysis and compliance

- [Inventory models](https://github.com/trusera/ai-bom/blob/main/src/ai_bom/models.py): `src/ai_bom/models.py`
- [Risk scoring](https://github.com/trusera/ai-bom/blob/main/src/ai_bom/utils/risk_scorer.py): `src/ai_bom/utils/risk_scorer.py`
- [LLM enrichment](https://github.com/trusera/ai-bom/blob/main/src/ai_bom/enrichment/llm_enricher.py): `src/ai_bom/enrichment/llm_enricher.py`
- [Compliance checks](https://github.com/trusera/ai-bom/tree/main/src/ai_bom/compliance): `src/ai_bom/compliance`
- [Scan policy](https://github.com/trusera/ai-bom/blob/main/src/ai_bom/policy.py): `src/ai_bom/policy.py`

### Results and interfaces

- [CLI](https://github.com/trusera/ai-bom/blob/main/src/ai_bom/cli.py): `src/ai_bom/cli.py`
- [Report formats](https://github.com/trusera/ai-bom/tree/main/src/ai_bom/reporters): `src/ai_bom/reporters`
- [REST API](https://github.com/trusera/ai-bom/blob/main/src/ai_bom/server.py): `src/ai_bom/server.py`
- [Dashboard](https://github.com/trusera/ai-bom/tree/main/src/ai_bom/dashboard): `src/ai_bom/dashboard`
- [Callable models](https://github.com/trusera/ai-bom/tree/main/src/ai_bom/callable): `src/ai_bom/callable`

### Runtime monitoring

- [Python SDK](https://github.com/trusera/ai-bom/blob/main/trusera-agent-sdk/trusera_sdk/interceptor.py): `trusera-agent-sdk/trusera_sdk/interceptor.py`
- [TypeScript SDK](https://github.com/trusera/ai-bom/blob/main/trusera-sdk-js/src/interceptor.ts): `trusera-sdk-js/src/interceptor.ts`
- [Go SDK](https://github.com/trusera/ai-bom/blob/main/trusera-sdk-go/interceptor.go): `trusera-sdk-go/interceptor.go`
- [Event client](https://github.com/trusera/ai-bom/blob/main/trusera-sdk-js/src/client.ts): `trusera-sdk-js/src/client.ts`

### Editor and workflow integrations

- [VS Code extension](https://github.com/trusera/ai-bom/blob/main/vscode-extension/src/extension.ts): `vscode-extension/src/extension.ts`
- [n8n nodes](https://github.com/trusera/ai-bom/tree/main/n8n-node/nodes): `n8n-node/nodes`
- [n8n scanner](https://github.com/trusera/ai-bom/blob/main/n8n-node/lib/scanner.ts): `n8n-node/lib/scanner.ts`
- [n8n sidecar gate](https://github.com/trusera/ai-bom/blob/main/n8n-node/lib/sidecar/policyGate.ts): `n8n-node/lib/sidecar/policyGate.ts`

### Other components

- **Engineer**
- **AI application**
- **Trusera platform**

## Connections

- Engineer → CLI: invokes scan (evidence: `README.md`)
- CLI → Discovery scanners: scans project (evidence: `README.md`)
- Discovery scanners → Code detection: detects patterns (evidence: `src/ai_bom/detectors/llm_patterns.py`)
- Discovery scanners → Inventory models: builds inventory (evidence: `src/ai_bom/server.py`)
- Discovery scanners → Risk scoring: scores findings (evidence: `src/ai_bom/server.py`)
- CLI → Report formats: selects output (evidence: `README.md`)
- CLI → Scan policy: checks thresholds (evidence: `README.md`)
- CLI → Compliance checks: supports compliance (evidence: `README.md`)
- CLI → LLM enrichment: optionally enriches (evidence: `README.md`)
- Engineer → REST API: requests scan (evidence: `src/ai_bom/server.py`)
- REST API → Discovery scanners: starts scan (evidence: `src/ai_bom/server.py`)
- Engineer → Dashboard: views inventory (evidence: `README.md`)
- Inventory models → Callable models: feeds callable models (evidence: `README.md`)
- AI application → Python SDK: installs interception (evidence: `README.md`)
- AI application → TypeScript SDK: installs interception (evidence: `README.md`)
- AI application → Go SDK: wraps HTTP client (evidence: `README.md`)
- Python SDK → Trusera platform: sends events (evidence: `README.md`)
- TypeScript SDK → Event client: records and flushes (evidence: `trusera-sdk-js/src/client.ts`)
- Event client → Trusera platform: posts event batches (evidence: `trusera-sdk-js/src/client.ts`)
- Engineer → VS Code extension: scans workspace (evidence: `README.md`)
- Engineer → n8n nodes: runs workflow nodes (evidence: `README.md`)
- n8n nodes → n8n scanner: scans workflows (evidence: `n8n-node/nodes/TruseraWebhook/TruseraWebhook.node.ts`)
- n8n nodes → n8n sidecar gate: evaluates tool calls (evidence: `n8n-node/nodes/TruseraSidecarTool/TruseraSidecarTool.node.ts`)
- n8n sidecar gate → Trusera platform: evaluates Cedar policies (evidence: `n8n-node/lib/sidecar/policyGate.ts`)