Today we're opening the hosted AIsbom Platform at app.aisbom.io to everyone. If the open-source CLI answers "what's inside this model file right now?", the platform answers the questions that come next: what changed since last month? Which repos ship models at all? Can you send compliance something they can open without a Python environment?

What it is

The platform is a continuous AI Bill of Materials — an inventory of every ML artifact across your connected repos, kept current by your own CI. You don't upload files to us, and there is no agent to install. The same GitHub Action that scans and comments on PRs gains one optional input: 

- uses: Lab700xOrg/aisbom@v1
  with:
    directory: models/
    token: ${{ secrets.AISBOM_TOKEN }}

With the token set, every scan posts its CycloneDX SBOM to your dashboard. From there you get:

  • A living inventory — every artifact's name, hash, license, format, and risk level, filterable across repos and branches.
  • Drift history — when a hash changed, a license flipped, or a CRITICAL finding appeared, traced to the PR that introduced it.
  • Shareable executive links — a read-only risk summary that auditors can open without an account, revocable any time.
  • Executive PDF reports — one click, formatted for the people who don't read JSON.

What it isn't

It is not a change to the open-source tool. The CLI stays free, fully useful offline, and the default behavior of the GitHub Action is unchanged: no token, no upload, nothing sent. We built our reputation on a scanner you can audit — disassembling pickle opcodes instead of executing them — and the platform follows the same posture: the upload is opt-in, announced loudly in your CI logs on every run, and documented field-by-field in the README's data-flow section. What's sent is the SBOM — the structure and findings of your model files, never weights or file contents. Data is stored in Cloudflare's EU jurisdiction.

Why a platform at all

A single scan is a snapshot, and snapshots go stale the moment the next PR merges. The teams using AIsbom in CI kept asking the same questions: which of our repos actually ship models, what did the inventory look like at the release we shipped in March, and how do we show this to a customer's security review without a screen-share. Those are history questions, and history needs a place to live. Your CI already produces the data; the platform just refuses to throw it away.

Pricing

There's a free tier — connect a repo and start building your inventory today. Paid Starter and Team tiers add more repos, longer history, and team features; see aisbom.io/pricing. Your SBOMs are standard CycloneDX JSON and exportable at any time — if you leave, you take the record with you.

Get started

Sign in with GitHub at app.aisbom.io, generate a per-repo token at app.aisbom.io/connect, and add the token input to your workflow — or start from the snippet above if you're new to the Action. Two minutes from sign-in to your first inventoried scan — and if you hit anything rough, tell us.