OWASP

license

Apache-2.0(OSI

source

public

core features withheld

no

The generator is Apache-2.0, as its LICENSE text shows despite the repository's unclassified label, and nothing is sold beside it.

• https://cdn.jsdelivr.net/gh/GenAI-Security-Project/aibom-generator@main/LICENSE recorded 2026-09-26

  "Apache License Version 2.0"; "Copyright 2026 OWASP Foundation - AI SBOM Generator and contributors Licensed under the Apache License, Version 2.0"

• https://cdn.jsdelivr.net/gh/GenAI-Security-Project/aibom-generator@main/README.md recorded 2026-09-26

  "the official GitHub repository for the OWASP AIBOM Generator — an open-source tool"; runs "under the OWASP GenAI Security Project"

• https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GenAI-Security-Project%2Faibom-generator recorded 2026-09-26

  GenAI-Security-Project/aibom-generator: GitHub license label other, archived false, pushed 2026-09-02

• https://ungh.cc/repos/GenAI-Security-Project/aibom-generator/files/main recorded 2026-09-26

  Full file listing, 70 paths; no ee/, enterprise/, commercial/ or proprietary/ directory

GitHub stars are the only signal. The tool publishes no package, and its hosted instance reports no usage. A star is not a use.

• https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GenAI-Security-Project%2Faibom-generator recorded 2026-09-26

  GenAI-Security-Project/aibom-generator: 100 stargazers

Its output is a CycloneDX document that any consumer can validate with standard tools, without relying on the generator. The contents repeat what the model publisher declared, so it sits two steps below NVIDIA's hardware attestation.

• https://cdn.jsdelivr.net/gh/GenAI-Security-Project/aibom-generator@main/README.md recorded 2026-09-26

  "Generates an AIBOM (AI Bill of Materials) in CycloneDX 1.6 JSON format"; "Calculates AIBOM completeness scoring"; "Built on CycloneDX Python Library — BOM generation, schema validation"