AI Assets

The AI Assets Inventory displays the AI components discovered in your repositories by the AI Security Scanner, including:

• AI Models (LLM references, embeddings, multimodal models)

• AI Agents and agent servers

• AI Frameworks (LangChain, LangGraph, CrewAI, AutoGen, Semantic Kernel, LlamaIndex, ...)

• MCP Servers and tools

• AI Skills (coding-tool skill manifests such as SKILL.md / AGENTS.md)

• Prompts, guardrails, vector stores, datasets and inference endpoints

• Coding tools (GitHub Copilot, Cursor, Claude Code, ...)

Every asset is cross-linked with the AI Security findings raised on it, so you can navigate from an asset to its risks — and from a risk back to the asset.

You can reach the AI Assets Inventory page by selecting the AI Assets tab at the top of any Inventory page, or through the AI assets link on the AI Risks screen.

The page header shows the date of the last scan, a List of risks link that jumps to the AI Risks screen scoped to the current project selection, and — when a single project or a group is selected — the Download AI-BOM button and the Statistics / AI Graph view toggle.

Statistics view

The default Statistics view displays:

• Total AI assets — with the number of assets at risk (i.e. with security issues).

• AI assets by Type — distribution chart of the inventory across asset types.

• AI assets by type and severity — a per-type breakdown of the open AI Security issues by severity.

• A table with the full list of AI assets.

The information for each asset:

• Risk level (0–100 score)

• Variation of the risk level from the project baseline

• Name

• Number of critical issues

• Asset type (AI Model, AI Agent, AI Skill, MCP Server, Coding tool, ...)

• Provider / system (OpenAI, Anthropic, LangChain, ...)

• Location (repository and file where the asset was detected)

• Links to the details and the pivot graph of the asset

The table can be filtered by system, asset name pattern, risk level, asset type, provider pattern, and location pattern, and the list can be exported to CSV.

AI Graph view

The AI Graph view renders the AI inventory as a relationship graph: agents that use models, execute tools, invoke MCP servers, or train on datasets. The legend maps node colors to asset types, and the graph can be filtered by relationship kind.

Clicking a node opens the asset detail slide-in; aggregated nodes ("(N)") open a summary of the grouped assets.

AI Asset details

Clicking on any row (or on the details icon) opens the AI asset detail slide-in. The header shows the asset's risk score, the provider/framework icon, and the asset name with the file where it was declared.

The Findings tab is organised in sections — a section is only shown when the scanner reported data for it:

• Identity — type, framework, provider, repository, file, owner, first detected / last seen dates.

• Capabilities — the capabilities or skills the asset exposes (e.g. retrieval, code-execution), with Human-in-loop / Tool call / Auto-execute flags when known.

• Models & Providers — the LLM(s) referenced by the asset, its framework, vector DB, and SDK version.

• Data Sources — the data the asset touches, with PII and data-classification flags, plus the network destinations it reaches.

• Issues by category and severity — the open AI Security issue counters, the guardrail coverage status (Guardrails ON / No guardrails), the Top 5 issues detected as AI inline (each one opens the full AI issue detail), and a View N issues button that jumps to the AI Risks screen.

• Lifecycle — version, last commit, last invocation.

• Governance — committee approval, EU AI Act risk category, data classification, and compliance flags.

• Declaration — the source code snippet where the asset is declared.

The Audit trail tab shows a month-by-month timeline of the security issues detected on the asset, with a View details link on each entry.

Download AI-BOM

For a selected project, the Download AI-BOM button exports the AI inventory as an AI Bill of Materials in CycloneDX 1.6 ML-BOM format (JSON) — the machine-readable counterpart of this screen, listing the models, agents, frameworks, and other AI components of the project together with the security findings linked to them.

The AI-BOM export is single-project: with a group or the All projects scope selected, the button asks you to pick one project first. If the selected project has no AI inventory yet (it was never scanned with the AI Security Scanner), the download reports an error asking for a re-scan.

The AI-BOM is also available from the Download BOM menu on the All Assets page, next to the SBOM (CycloneDX / SPDX) and CBOM exports.