A real, freshly-generated AI Bill of Materials — a valid CycloneDX 1.6 BOM, the same
out/aibom.json a local agentaudit run produces. Built from a single ast parse
of the agent (never imported or executed); every tool's capability class comes straight from the same
classify_tool() the Layer 2 engine uses. See
references/aibom_format.md
for the CycloneDX-vs-custom-schema decision.
{
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"serialNumber": "urn:uuid:4c804d4b-968d-5776-87a8-4bf6adf1f0e2",
"version": 1,
"metadata": {
"timestamp": "2026-09-12T20:42:25Z",
"tools": {
"components": [
{
"type": "application",
"bom-ref": "agentaudit",
"name": "AgentAudit",
"version": "0.1.0"
}
]
},
"component": {
"type": "application",
"bom-ref": "agent:northwind-support-vulnerable",
"name": "northwind-support-vulnerable",
"version": "2ce85c2",
"description": "Strands agent \u2014 AgentAudit AIBOM",
"properties": [
{
"name": "agentaudit:sourcePath",
"value": "fixtures/vulnerable_agent.py"
},
{
"name": "agentaudit:sourceSha256",
"value": "c41d4c1b927d3011523bee732b96448752d171d48b8e3e67d9d1524c216eae3a"
},
{
"name": "agentaudit:framework",
"value": "strands-agents"
},
{
"name": "agentaudit:toolCount",
"value": "3"
},
{
"name": "agentaudit:capabilityPairCount",
"value": "0"
},
{
"name": "agentaudit:systemPromptStaticallyDeterminable",
"value": "true"
},
{
"name": "agentaudit:modelStaticallyDeterminable",
"value": "false"
},
{
"name": "agentaudit:deployConfig",
"value": "fixtures/vulnerable_agent.deploy.json"
},
{
"name": "agentaudit:gitRemote",
"value": "https://github.com/TOUMO45/AgentAudit"
},
{
"name": "agentaudit:gitCommit",
"value": "2ce85c205e7e1396719948d27ffda4e50afbff2c"
},
{
"name": "agentaudit:gitBranch",
"value": "master"
},
{
"name": "agentaudit:gitWorkingTreeDirty",
"value": "false"
}
]
}
},
"components": [
{
"type": "application",
"bom-ref": "tool:get_account_balance",
"name": "get_account_balance",
"description": "Get the balance for a customer account.",
"properties": [
{
"name": "agentaudit:componentKind",
"value": "agent-tool"
},
{
"name": "agentaudit:definedAt",
"value": "fixtures/vulnerable_agent.py:35"
},
{
"name": "agentaudit:untrustedParam",
"value": "account_id"
}
]
},
{
"type": "application",
"bom-ref": "tool:process_refund",
"name": "process_refund",
"description": "Process a small customer refund.",
"properties": [
{
"name": "agentaudit:componentKind",
"value": "agent-tool"
},
{
"name": "agentaudit:definedAt",
"value": "fixtures/vulnerable_agent.py:47"
},
{
"name": "agentaudit:untrustedParam",
"value": "account_id"
},
{
"name": "agentaudit:untrustedParam",
"value": "amount"
}
]
},
{
"type": "application",
"bom-ref": "tool:lookup_diagnostic",
"name": "lookup_diagnostic",
"description": "Look up a read-only diagnostic record for a support case.",
"properties": [
{
"name": "agentaudit:componentKind",
"value": "agent-tool"
},
{
"name": "agentaudit:definedAt",
"value": "fixtures/vulnerable_agent.py:63"
},
{
"name": "agentaudit:untrustedParam",
"value": "query"
}
]
}
],
"dependencies": [
{
"ref": "agent:northwind-support-vulnerable",
"dependsOn": [
"tool:get_account_balance",
"tool:process_refund",
"tool:lookup_diagnostic"
]
}
]
}