CycloneDX and SPDX are both in play in supply-chain tooling, and which one a customer or auditor asks for is not up to you — emitting both removes that negotiation. The completeness audit is the tool to run first: an incomplete bill of materials is the normal starting state, and knowing which fields are empty is more useful than a document that looks finished.
A server for building an AI Bill of Materials — the inventory of models, data and components behind an AI system — in the two standard formats, which EU AI Act Article 11 documentation requires.
- `generate_ai_bom` — produce the bill of materials itself, in CycloneDX and SPDX form
- `audit_ai_bom_completeness` — check what is missing before anyone else does
- `map_to_regulation` — connect the inventory to the regulatory requirement it answers
The PyPI package ai-bom-mcp, version 1.2.20, over stdio — `uvx ai-bom-mcp` in your client config, or `pip install ai-bom-mcp` and run the `ai-bom-mcp` command. There is also a Smithery install path. No account or key is documented for the tools themselves.
One command — pip install ai_bom_mcp