Skip to content

Commit cd5b90c

Browse files
committed
docs: synchronizing help from snyk/user-docs
1 parent 7166e55 commit cd5b90c

File tree

1 file changed

+31
-10
lines changed

1 file changed

+31
-10
lines changed

help/cli-commands/aibom.md

Lines changed: 31 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,43 @@
1-
# AIBOM
1+
# AI-BOM
22

3-
## Prerequisites
3+
**Note**: AI-BOM is an experimental feature and is subject to breaking changes without notice.
44

5-
**Feature availability:** This experimental feature is available to customers on request. If you want to use this feature, contact your Snyk representative to get access. Then download the CLI from the preview release channel.
5+
## Prerequisites
66

7-
The `snyk aibom` feature requires an internet connection.
7+
- The `snyk aibom` feature requires an internet connection. 
8+
- Install the Snyk CLI from the [preview release](../../../snyk-cli/releases-and-channels-for-the-snyk-cli.md#preview) channel.
9+
- Your Project must be Python and with a [package manager](../../../supported-languages-package-managers-and-frameworks/python/) supported by Snyk.
810

911
## Usage
1012

1113
`$ snyk aibom --experimental [<OPTION>]`
1214

1315
## Description
1416

15-
The `snyk aibom` command generates an AIBOM for a local software project that is written in Python.
17+
The `snyk aibom` command generates an AI-BOM for a local software project that is written in Python. You can use the `snyk aibom` command to identify AI models, datasets, and map the AI supply chain, including connections to external tools and services using the Model Context Protocol (MCP).
18+
19+
The supported format is CycloneDX v1.6 (JSON).
20+
21+
In the JSON file, you can see the following AI dependencies and components:
22+
23+
- **Models:** You can see your usage of foundational models (such as GPT-4) and open source models (such as Llama-4). Where possible, the information surfaced also refers to model card, license, and other information.
24+
- **Agents:** Identified based on popular AI agent libraries.
25+
- **Tools:** Identified based on popular patterns of tool calling.
26+
- **MCPs:** Identified based on the official MCP SDK, in addition to other popular ways of building MCPs.
27+
28+
## MCP and your AI-BOM
29+
30+
A key feature of the `snyk aibom` command is its ability to detect and map dependencies established using the MCP.
31+
32+
MCP is an open standard that applications use to connect LLMs with external tools, data sources, and services. These connections create a new layer in your AI supply chain that needs to be monitored for security and compliance.
33+
34+
`snyk aibom` analyzes your source code to identify and categorize MCP components into a clear dependency graph:
1635

17-
Use the `snyk aibom` command to understand what AI models, datasets, tools, and so on are used in that project.
36+
- **MCP client**: The component in your code that initiates a connection to a server.
37+
- **MCP server**: The component providing tools or resources. This can be a local script or a remote network service.
38+
- **Tools and resources**: The specific functions (tool) or data (resource) made available by an MCP server.
1839

19-
The current supported format is CycloneDX v1.6 (JSON).
40+
When you run `snyk aibom`, the output shows these dependencies clearly. For example, you can see a chain showing that your root application depends on an mcp-client, which depends on an mcp-server, which in turn provides a specific tool. This gives you full visibility into the services your AI application relies on.
2041

2142
## Options
2243

@@ -32,14 +53,14 @@ If you have multiple Organizations, you can set a default from the CLI using:
3253

3354
`$ snyk config set org=<ORG_ID>`
3455

35-
Set a default to ensure all newly tested projects are tested under your default Organization. If you need to override the default, use the `--org=<ORG_ID>` option.
56+
Set a default to ensure all newly tested Projects are tested under your default Organization. If you need to override the default, use the `--org=<ORG_ID>` option.
3657

3758
Default: `<ORG_ID>` that is the current preferred Organization in your [Account settings](https://app.snyk.io/account)
3859

3960
### `--html`
4061

41-
Optional. Embed the AIBOM into an HTML visualization of the AIBOM components and their relationships.
62+
Optional. Embed the AI-BOM into an HTML visualization of the AI-BOM components and their relationships.
4263

4364
### `[--json-file-output]`
4465

45-
Optional. Save the AIBOM output as a JSON data structure directly to the specified file.
66+
Optional. Save the AI-BOM output as a JSON data structure directly to the specified file.

0 commit comments

Comments
 (0)