Your AI supply chain, on one dashboard.

The CLI tells you what's in a model today. The hosted platform remembers — every scan from every PR, across all your repos, so you can see what changed, prove what shipped, and hand compliance a link instead of a meeting.

From PR comment to permanent record in one input

Connect a repo

Add one line to your workflow

Already running the AIsbom Action on PRs? Add the token input and every scan also posts its SBOM to your dashboard. New to AIsbom? The snippet below is the whole workflow step.

Browse, diff, share

Your inventory builds itself from real CI traffic. Filter by risk, drill into any artifact, and share an executive view when someone asks "what models are we running?"

- uses: Lab700xOrg/aisbom@v1
  with:
    directory: models/
    token: ${{ secrets.AISBOM_TOKEN }}

What you get

Continuous inventory

Every model artifact across every connected repo and branch — name, hash, license, format, and risk level — kept current by your own CI, not by quarterly spreadsheet archaeology.

Drift history

See when a model's hash changed, a license flipped, or a new CRITICAL finding appeared — with the scan history to show exactly which PR introduced it.

Shareable executive links

Generate a read-only link to a repo's risk summary that auditors and compliance stakeholders can open without an account. Revoke it any time.

Executive PDF reports

One-click PDF of a repo's AI BOM posture — inventory, risk summary, scan provenance — formatted for the people who don't read JSON.

EU data residency

SBOM data is stored in Cloudflare's EU jurisdiction (D1 + R2). What's sent is the SBOM — structure and findings of your model files, never weights or file contents.

Loud, opt-in data flow

Nothing uploads unless you set the token, and every upload is announced in your CI logs. Remove the token and the Action is purely local again. Full data-flow docs

Built on an open-source scanner you can audit

The platform doesn't replace the open-source CLI — it's fed by it. The same deep binary introspection that disassembles pickle opcodes and parses SafeTensors and GGUF headers runs in your CI; the platform is where those results become a living record. The CLI stays free, open source, and fully useful without an account.

Free tier — connect a repo and start building your inventory today.
Starter & Team tiers — more repos, longer history, team features. Pricing
No lock-in — your SBOMs are standard CycloneDX JSON; export any time.

Start with the free tier

Two minutes from sign-in to your first inventoried scan.