Hi Product Hunt 👋 I'm David, the maker. I've spent 25 years in infrastructure and security (CCIE #14019). Every SBOM tool I ran did the same thing: list your dependencies, hand you a JSON file, and treat compliance as your problem from there. None of them saw the part I actually worried about, the AI models and the agents now wired into production. So I built SBOMix. Point it at any repo: npx sbomix . In a couple of seconds you get CycloneDX 1.6, SPDX 2.3, and an AI-BOM. The AI-BOM is the part I care about most: it inventories your models, your API providers, and every MCP server an agent can reach, each with its authority scope (shell access, broad filesystem, unpinned source) and a Least Agency Score. sbomix ai-bom . gives you that as a plain-language report. Two more things it does that a normal scanner won't: sbomix cra-check maps your repo to EU Cyber Resilience Act requirements, quoted verbatim, and is honest about what a scan can prove versus what a human still has to. It never fakes a green pass and never assigns your product a compliance class. sbomix --profile crypto-agent answers "what's in the agent holding our keys" for teams shipping autonomous agents. The CLI is MIT licensed and free forever. No account, no Docker, no agent to install. There's an optional hosted dashboard if you want org-wide tracking and alerts. I'd genuinely love feedback, especially on the AI-BOM output. Run it on your messiest repo and tell me what it missed. I'll be here all day.

SBOMix

The SBOM tool that also inventories your AI and agents

The SBOM tool that also inventories your AI and agents