Find every AI in your code.Before your auditor does.

One scan, no questionnaire. Every model, dataset, prompt, agent, MCP server and guardrail catalogued.

Talk to the founders

One sweep of the repository. Hover a blip for what it covers.108assets found

Every footprint, counted, pinned, flagged.

Six classes, every item tied to a file and a line, flagged when a model card, a license or a scope is missing.

Models

OpenAI · Anthropic · HuggingFace · local GGUF

openai/gpt-4o-minisrc/lib/chat.ts:23governed
meta-llama/Llama-3.1-8Bmodels/local.ggufshadow
anthropic/claude-3-7-sonnetapps/agent/index.ts:11governed

Datasets

training, fine-tune, eval, RAG corpora

wikipedia-en-2024notebooks/finetune.ipynbgoverned
customer_chats_v2data/training.parquetshadow
hf://glaive/code-instructscripts/data.py:8governed

Prompts

versioned system + user templates

chat-system@v3prompts/system.mdgoverned
extract-piilib/pii.ts:17drift
triage-flow@v7agents/triage.yamlgoverned

Agents

ReAct · LangChain · LlamaIndex · CrewAI

LangChain ReActapps/agent/main.pygoverned
LlamaIndex query engineapps/rag/server.tsshadow
Custom MCP hostservices/mcp-host/governed

MCP servers

tools the agents call out to

mcp://github.local:7001agents/.mcp.jsongoverned
mcp://internal-tools.cybeapps/agent/mcp.tomlgoverned
mcp://prod-postgresinfra/mcp.ts:42shadow

Guardrails

Llama Guard · Guardrails AI · NeMo

Llama Guard 3 8Binfra/guardrails.ts:9governed
Guardrails AI · OutputParserlib/safety.ts:14governed
(none)apps/legacy-agent/missing

EU AI Act Annex IV evidence. One scan to ship it.

One report per scan, mapped to Regulation (EU) 2024/1689, ready for legal and your auditor.

CYBEDEFEND

EU AI Act Compliance Report

Project: 4c61150d-ee1f-4a7f-b40f-49902ceab318
Framework: eu-ai-act v1.0
Legal reference: Regulation (EU) 2024/1689
Scan date: 2026-05-21

Executive SummaryAction Required

One or more prohibited or high-risk components detected. Review §4: these require action before deployment.

Total components171

GPAI components104

Systemic risk3

StatusAction Required

By risk category (Art. 5/6/50)

Prohibited11

High7

Limited12

Minimal141

§1: General description of the AI system (Annex IV §1)171 AI components detected, sorted by risk severity.

Component	Type	Risk
`acme/behavioral-social-scor-v2`	ML model	Prohibited
`acme/credit-scorer-v2`	ML model	High
`acme/customer-chatbot-v4`	ML model	Limited
`openai/gpt-4o-mini`	ML model	Minimal
`anthropic/claude-sonnet-4-5`	ML model	Minimal

+166 more components in the full report

Run it where you ship. GitHub Actions, GitLab CI, Jenkins, Tekton.

Add the cybedefend-action to your GitHub workflow, or call the CybeDefend CLI from any other pipeline.

.github/workflows/ai-bom.yml

- name: CybeDefend Security Scan
  uses: CybeDefend/cybedefend-action@v2
  with:
    pat: ${{ secrets.CYBEDEFEND_PAT }}
    project_id: ${{ secrets.CYBEDEFEND_PROJECT_ID }}
    branch: ${{ github.ref_name }}
    break_on_severity: high

You can’t govern the AI you can’t see. Shadow AI is already in your repos.

Discovery first

Every model, dataset, prompt, agent, MCP server and guardrail surfaced automatically.

EU AI Act Annex IV native

Every Annex IV section has a corresponding emit rule. Article 11 documentation moves from a quarterly project to a CI artefact.

NIST AI RMF aligned

Each component is tagged against the Govern / Map / Measure / Manage functions.

How it works,
in detail.

The documentation walks you through setup, configuration and every option.

Read the docs

Platform Overview / Key Features

AI-BOM & EU AI Act Compliance

What gets detected and how, the inventory, the EU AI Act risk categories and the compliance report.

What AI-BOM catches, what it does not.

What exactly does AI-BOM detect?

Models referenced by name (HuggingFace IDs, OpenAI / Anthropic / Google model strings, local .gguf / .onnx weights), datasets referenced in code or config, versioned prompts shipped in the repo, MCP server URLs consumed by your agents, LangChain and LlamaIndex graphs, agent orchestration frameworks (Semantic Kernel, AutoGen, CrewAI, custom ReAct), and guardrails libraries in use (Llama Guard, NeMo, Guardrails AI). Each item lands in the inventory with its source location, version pin, and a heuristic classification.

Is AI-BOM required by the EU AI Act?

Article 11 and Annex IV of the EU AI Act require a technical documentation pack for high-risk AI systems before they enter the EU market. That pack enumerates models, training data sources, intended use, performance metrics, and risk-management measures. AI-BOM produces the evidence in machine-readable form, so the documentation step becomes an export instead of a quarterly project.

How does it integrate into CI/CD?

Add the cybedefend-action to your GitHub workflow, or call the CybeDefend CLI from any other pipeline (GitLab CI, Jenkinsfile, Tekton). The scan runs on every push, the report is published as a build artifact, and the gate exits non-zero when a new prohibited or high-risk component lands without governance documentation.

What is the difference between AI-BOM and SBOM?

SBOM lists software components and CVEs. AI-BOM lists AI components and their AI-specific governance facets: training data origin, fine-tune lineage, prompt versions, agent capability scope, guardrails coverage, residual risk. They are complementary; CybeDefend produces both, and the AI-BOM output is also exportable as CycloneDX so it slots into your existing SBOM tooling.

Does AI-BOM train on our code?

No. The scan reads your repository and produces a structured inventory; source code does not leave your environment. The optional dashboard receives metadata only (component names, versions, risk classification), never raw code or prompt content.

Run the scan. See your AI inventory in 4 seconds.

Free first scan. No credit card.