OWASP AIBOM Generator
OWASPThe OWASP AIBOM Generator produces AI Bills of Materials in CycloneDX 1.6 JSON for models hosted on Hugging Face, extracting metadata from model cards, configurations and repository files. It scores how complete each bill of materials is and suggests what is missing, and is listed in the CycloneDX Tool Center. It runs under the OWASP GenAI Security Project, with a hosted instance for trying it.
Tagged self-attested: the bill of materials validates against the CycloneDX schema, but repeats what the model's publisher declared.
Openness
5 high confidence- license
- Apache-2.0(OSI
- source
- public
- core features withheld
- no
The generator is Apache-2.0, as its LICENSE text shows despite the repository's unclassified label, and nothing is sold beside it.
- https://cdn.jsdelivr.net/gh/GenAI-Security-Project/aibom-generator@main/LICENSE recorded 2026-09-26
"Apache License Version 2.0"; "Copyright 2026 OWASP Foundation - AI SBOM Generator and contributors Licensed under the Apache License, Version 2.0"
- https://cdn.jsdelivr.net/gh/GenAI-Security-Project/aibom-generator@main/README.md recorded 2026-09-26
"the official GitHub repository for the OWASP AIBOM Generator — an open-source tool"; runs "under the OWASP GenAI Security Project"
- https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GenAI-Security-Project%2Faibom-generator recorded 2026-09-26
GenAI-Security-Project/aibom-generator: GitHub license label other, archived false, pushed 2026-09-02
- https://ungh.cc/repos/GenAI-Security-Project/aibom-generator/files/main recorded 2026-09-26
Full file listing, 70 paths; no ee/, enterprise/, commercial/ or proprietary/ directory
Adoption
1 low confidenceGitHub stars are the only signal. The tool publishes no package, and its hosted instance reports no usage. A star is not a use.
- https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GenAI-Security-Project%2Faibom-generator recorded 2026-09-26
GenAI-Security-Project/aibom-generator: 100 stargazers
Capability
3 medium confidenceIts output is a CycloneDX document that any consumer can validate with standard tools, without relying on the generator. The contents repeat what the model publisher declared, so it sits two steps below NVIDIA's hardware attestation.
- https://cdn.jsdelivr.net/gh/GenAI-Security-Project/aibom-generator@main/README.md recorded 2026-09-26
"Generates an AIBOM (AI Bill of Materials) in CycloneDX 1.6 JSON format"; "Calculates AIBOM completeness scoring"; "Built on CycloneDX Python Library — BOM generation, schema validation"
Verified 2026-09-26