SafeDep Documentation

vet finds the AI libraries, SDKs, and agent frameworks your application actually calls. It scans source code, matches call sites against signatures for known AI SDKs, and writes each match into its CycloneDX output as an extended Bill of Materials (xBOM). The AI components, each marked with an ai property and file and line evidence, are your AI BOM. Because the inventory comes from call sites, it shows what the code calls, not just what the manifests declare. Coverage tracks the AI ecosystem in current use:

Model providers: OpenAI, Anthropic, Google Gemini, xAI Grok, Mistral, Cohere, Groq, Ollama, AWS Bedrock, Hugging Face, and more
Frameworks and agent SDKs: LangChain, LangGraph, LlamaIndex, CrewAI, Vercel AI SDK, OpenAI Agents SDK, Claude Agent SDK, Pydantic AI, Spring AI, Semantic Kernel, and the Model Context Protocol (MCP) SDKs
Languages: Python, JavaScript, TypeScript, Java, and Go. Each SDK is covered in the languages it supports.

Browse the full signature set. AI is one xBOM category: the same scan also detects cryptographic, cloud, network, filesystem, and process usage (see the vet xBOM documentation).

Prerequisites

vet installed
Access to the source code you want to analyze

Generate the AI BOM

Scan the source code

The first pass parses your source files, matches them against the embedded signatures, and stores the results in a local SQLite database. Point --app at your own code:

vet code scan --db code.db --app ./src

Skip test and generated code with --exclude (a regular expression), and restrict languages with --lang when you want a faster scan:

vet code scan --db code.db \
  --app ./src \
  --lang python \
  --exclude ".*test.*" --exclude ".*__pycache__.*"

Write the CycloneDX BOM

The second pass runs a normal vet scan, enriches it with the recorded detections, and writes the BOM:

vet scan -D ./src --code code.db --report-cdx xbom.json

xbom.json is a standard CycloneDX document that carries the code-analysis detections alongside the declared packages. Every AI component in it has the ai property, so downstream tooling can filter on it.

Inspect detections directly (optional)

You can review what vet found without generating a BOM. Query the database for matches tagged ai:

vet code query --db code.db --tag ai

Narrow the results by language, vendor, or file path:

vet code query --db code.db --tag ai --language python --limit 200
vet code query --db code.db --vendor OpenAI
vet code query --db code.db --file src/agents/

Read the AI BOM

AI SDK calls detected in your code appear as standalone components with an xbom: bom-ref. The signature’s vendor becomes the publisher, the ai property marks the component, and each occurrence records where the call sits in your source. This component records an Anthropic client constructed on line 3 of src/app.py:

{
  "bom-ref": "xbom:anthropic.client",
  "type": "library",
  "name": "Anthropic API - AI client",
  "publisher": "Anthropic",
  "evidence": {
    "occurrences": [
      {
        "location": "src/app.py",
        "line": 3,
        "additionalContext": "anthropic//Anthropic"
      }
    ]
  },
  "properties": [
    { "name": "ai", "value": "true" }
  ]
}

additionalContext shows the matched call in the analyzer’s namespace notation, with // separating the module path from the symbol. Detection follows calls, so an SDK that is imported but never called produces no component. If you scan vendored dependency source through --import-dir, vet attempts to attach those detections to the corresponding declared package instead of a standalone component. More AI SDKs and libraries are added to vet xBOM coverage over time.

Filter the AI components

The ai property makes the AI BOM easy to extract from the full document. With jq:

jq '.components[] | select(.properties[]? | .name == "ai" and .value == "true") | .name' xbom.json

Providers reached through the OpenAI-compatible mode of the openai SDK (DeepSeek and Moonshot document this as their official path) appear as OpenAI usage, because the code calls the openai SDK.

Run it in CI

Generate the BOM on each build and keep it as an artifact:

- name: Build code analysis database
  run: vet code scan --app ./src --db code.db

- name: Generate xBOM with AI components
  run: vet scan -D ./src --code code.db --report-cdx xbom.json

CycloneDX SBOM

Generate a standard CycloneDX SBOM with vet.

What is an SBOM?

How CycloneDX BOMs and xBOMs relate.

Code Analysis

The static analysis engine behind the xBOM.

​Prerequisites

​Generate the AI BOM

​Read the AI BOM

​Filter the AI components

​Run it in CI

CycloneDX SBOM

What is an SBOM?

Code Analysis

Prerequisites

Generate the AI BOM

Read the AI BOM

Filter the AI components

Run it in CI