> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safedep.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Generate an AI BOM with vet

> Build an AI Bill of Materials from source code with vet's xBOM engine: AI SDK detections in CycloneDX with file and line evidence.

`vet` finds the AI libraries, SDKs, and agent frameworks your application actually calls. It scans source code, matches call sites against signatures for known AI SDKs, and writes each match into its [CycloneDX](/concepts/sbom) output as an extended Bill of Materials (xBOM). The AI components, each marked with an `ai` property and file and line evidence, are your AI BOM.

Because the inventory comes from call sites, it shows what the code calls, not just what the manifests declare.

Coverage tracks the AI ecosystem in current use:

* **Model providers:** OpenAI, Anthropic, Google Gemini, xAI Grok, Mistral, Cohere, Groq, Ollama, AWS Bedrock, Hugging Face, and more
* **Frameworks and agent SDKs:** LangChain, LangGraph, LlamaIndex, CrewAI, Vercel AI SDK, OpenAI Agents SDK, Claude Agent SDK, Pydantic AI, Spring AI, Semantic Kernel, and the Model Context Protocol (MCP) SDKs
* **Languages:** Python, JavaScript, TypeScript, Java, and Go. Each SDK is covered in the languages it supports.

Browse the [full signature set](https://github.com/safedep/vet/tree/main/signatures). AI is one xBOM category: the same scan also detects cryptographic, cloud, network, filesystem, and process usage (see the [vet xBOM documentation](https://github.com/safedep/vet/blob/main/docs/xbom.md)).

## Prerequisites

* `vet` [installed](/governance/vet/quickstart)
* Access to the source code you want to analyze

## Generate the AI BOM

<Steps>
  <Step title="Scan the source code">
    The first pass parses your source files, matches them against the embedded signatures, and stores the results in a local SQLite database. Point `--app` at your own code:

    ```bash theme={null}
    vet code scan --db code.db --app ./src
    ```

    Skip test and generated code with `--exclude` (a regular expression), and restrict languages with `--lang` when you want a faster scan:

    ```bash theme={null}
    vet code scan --db code.db \
      --app ./src \
      --lang python \
      --exclude ".*test.*" --exclude ".*__pycache__.*"
    ```
  </Step>

  <Step title="Write the CycloneDX BOM">
    The second pass runs a normal `vet` scan, enriches it with the recorded detections, and writes the BOM:

    ```bash theme={null}
    vet scan -D ./src --code code.db --report-cdx xbom.json
    ```

    `xbom.json` is a standard CycloneDX document that carries the code-analysis detections alongside the declared packages. Every AI component in it has the `ai` property, so downstream tooling can filter on it.
  </Step>

  <Step title="Inspect detections directly (optional)">
    You can review what `vet` found without generating a BOM. Query the database for matches tagged `ai`:

    ```bash theme={null}
    vet code query --db code.db --tag ai
    ```

    Narrow the results by language, vendor, or file path:

    ```bash theme={null}
    vet code query --db code.db --tag ai --language python --limit 200
    vet code query --db code.db --vendor OpenAI
    vet code query --db code.db --file src/agents/
    ```
  </Step>
</Steps>

## Read the AI BOM

AI SDK calls detected in your code appear as standalone components with an `xbom:` bom-ref. The signature's vendor becomes the publisher, the `ai` property marks the component, and each occurrence records where the call sits in your source. This component records an Anthropic client constructed on line 3 of `src/app.py`:

```json theme={null}
{
  "bom-ref": "xbom:anthropic.client",
  "type": "library",
  "name": "Anthropic API - AI client",
  "publisher": "Anthropic",
  "evidence": {
    "occurrences": [
      {
        "location": "src/app.py",
        "line": 3,
        "additionalContext": "anthropic//Anthropic"
      }
    ]
  },
  "properties": [
    { "name": "ai", "value": "true" }
  ]
}
```

`additionalContext` shows the matched call in the analyzer's namespace notation, with `//` separating the module path from the symbol. Detection follows calls, so an SDK that is imported but never called produces no component.

If you scan vendored dependency source through `--import-dir`, `vet` attempts to attach those detections to the corresponding declared package instead of a standalone component. More AI SDKs and libraries are added to `vet` xBOM coverage over time.

### Filter the AI components

The `ai` property makes the AI BOM easy to extract from the full document. With `jq`:

```bash theme={null}
jq '.components[] | select(.properties[]? | .name == "ai" and .value == "true") | .name' xbom.json
```

<Note>
  Providers reached through the OpenAI-compatible mode of the `openai` SDK (DeepSeek and Moonshot document this as their official path) appear as OpenAI usage, because the code calls the `openai` SDK.
</Note>

## Run it in CI

Generate the BOM on each build and keep it as an artifact:

```yaml theme={null}
- name: Build code analysis database
  run: vet code scan --app ./src --db code.db

- name: Generate xBOM with AI components
  run: vet scan -D ./src --code code.db --report-cdx xbom.json
```

<CardGroup cols={2}>
  <Card title="CycloneDX SBOM" icon="file-code" href="/governance/cyclonedx-sbom">
    Generate a standard CycloneDX SBOM with vet.
  </Card>

  <Card title="What is an SBOM?" icon="lightbulb" href="/concepts/sbom">
    How CycloneDX BOMs and xBOMs relate.
  </Card>

  <Card title="Code Analysis" icon="magnifying-glass" href="/governance/vet/code-analysis">
    The static analysis engine behind the xBOM.
  </Card>
</CardGroup>