Know which AI your code calls
Every monitored repository gets an AI bill of materials: the AI SDKs it imports, the models it names, the MCP servers it talks to and the prompts in its register. It is rebuilt on each scan of the default branch and exports as CycloneDX, so the answer to which services use which models is a download.
The AI each
repository ships
SDKs come from the resolved dependencies, model identifiers from the code, MCP servers from the configuration and implementation, and prompts from the AI register. One page per repository, anchored to the commit it describes, and refreshed with every scan of the default branch.
How it works
Model identifiers,
with their source
Every model id found in a string literal is listed with the file and line it comes from. When a provider retires a model, or your policy changes which ones are allowed, the list of places to change is already written down, with links into the code.
MCP servers by shape,
never by secret
MCP servers your tooling starts or calls are recorded by shape, with the names of the environment variables they read and never the values. The BOM tells a reviewer that a server needs a token without the BOM ever holding one.
A standard file
for your auditors
Each BOM is a CycloneDX 1.6 ML-BOM anchored to the commit it describes. Hand it to an auditor, or to the tools that already read CycloneDX for your software bill of materials. Prompts appear once prompt discovery has run, which it does with prompt evals and AI governance.
Included
Related
Security
Advisories assessed for reachability in your code, malware alerts within minutes, remediation pull requests and an AI bill of materials per repository.
Read morePrompt evals
inline finds the LLM prompts in your repository, writes happy path, edge, adversarial and boundary cases for each, runs them and grades the answers.
Read moreCompliance
inline finds the providers your code sends data to, reads the agreements you signed, and raises a finding for each provider used without cover.
Read more
Put it on one repository
Connect GitHub or GitLab, enable a repo, and the next pull request opened gets a review.