> For the complete documentation index, see [llms.txt](https://docs.xygeni.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.xygeni.io/xygeni-products/application-security-posture-management-aspm/inventory/ai-assets.md). # AI Assets The **AI Assets Inventory** displays the AI components discovered in your repositories by the [AI Security Scanner](/xygeni-products/ai-security/ai-security-scanner.md), including: * AI Models (LLM references, embeddings, multimodal models) * AI Agents and agent servers * AI Frameworks (LangChain, LangGraph, CrewAI, AutoGen, Semantic Kernel, LlamaIndex, ...) * MCP Servers and tools * AI Skills (coding-tool skill manifests such as `SKILL.md` / `AGENTS.md`) * Prompts, guardrails, vector stores, datasets and inference endpoints * Coding tools (GitHub Copilot, Cursor, Claude Code, ...) Every asset is cross-linked with the [AI Security](/xygeni-products/ai-security.md) findings raised on it, so you can navigate from an asset to its risks — and from a risk back to the asset. {% hint style="info" %} You can reach the **AI Assets Inventory** page by selecting the **AI Assets** tab at the top of any Inventory page, or through the **AI assets** link on the [AI Risks](/xygeni-products/ai-security/ai-security-user-interface-guide.md) screen. {% endhint %} The page header shows the **date of the last scan**, a **List of risks** link that jumps to the [AI Risks](/xygeni-products/ai-security/ai-security-user-interface-guide.md) screen scoped to the current project selection, and — when a single project or a group is selected — the **Download AI-BOM** button and the **Statistics / AI Graph** view toggle. ### Statistics view The default **Statistics** view displays: * **Total AI assets** — with the number of assets at risk (i.e. with security issues). * **AI assets by Type** — distribution chart of the inventory across asset types. * **AI assets by type and severity** — a per-type breakdown of the open AI Security issues by severity. * A table with the full list of AI assets. The information for each asset: * Risk level (0–100 score) * Variation of the risk level from the project baseline * Name * Number of critical issues * Asset type (AI Model, AI Agent, AI Skill, MCP Server, Coding tool, ...) * Provider / system (OpenAI, Anthropic, LangChain, ...) * Location (repository and file where the asset was detected) * Links to the details and the pivot graph of the asset The table can be filtered by **system**, **asset name pattern**, **risk level**, **asset type**, **provider pattern**, and **location pattern**, and the list can be exported to **CSV**. ### AI Graph view The **AI Graph** view renders the AI inventory as a relationship graph: agents that *use* models, *execute* tools, *invoke* MCP servers, or *train on* datasets. The legend maps node colors to asset types, and the graph can be filtered by relationship kind. Clicking a node opens the [asset detail](#ai-asset-details) slide-in; aggregated nodes ("(N)") open a summary of the grouped assets. ### AI Asset details Clicking on any row (or on the details icon) opens the **AI asset detail** slide-in. The header shows the asset's **risk score**, the provider/framework icon, and the asset name with the file where it was declared. The **Findings** tab is organised in sections — a section is only shown when the scanner reported data for it: * **Identity** — type, framework, provider, repository, file, owner, first detected / last seen dates. * **Capabilities** — the capabilities or skills the asset exposes (e.g. `retrieval`, `code-execution`), with *Human-in-loop* / *Tool call* / *Auto-execute* flags when known. * **Models & Providers** — the LLM(s) referenced by the asset, its framework, vector DB, and SDK version. * **Data Sources** — the data the asset touches, with PII and data-classification flags, plus the network destinations it reaches. * **Issues by category and severity** — the open AI Security issue counters, the guardrail coverage status (*Guardrails ON* / *No guardrails*), the **Top 5 issues detected as AI** inline (each one opens the full AI issue detail), and a **View N issues** button that jumps to the AI Risks screen. * **Lifecycle** — version, last commit, last invocation. * **Governance** — committee approval, **EU AI Act** risk category, data classification, and compliance flags. * **Declaration** — the source code snippet where the asset is declared. The **Audit trail** tab shows a month-by-month timeline of the security issues detected on the asset, with a *View details* link on each entry. ### Download AI-BOM For a selected project, the **Download AI-BOM** button exports the AI inventory as an **AI Bill of Materials** in [CycloneDX](https://cyclonedx.org/) **1.6 ML-BOM** format (JSON) — the machine-readable counterpart of this screen, listing the models, agents, frameworks, and other AI components of the project together with the security findings linked to them. {% hint style="info" %} The AI-BOM export is **single-project**: with a group or the *All projects* scope selected, the button asks you to pick one project first. If the selected project has no AI inventory yet (it was never scanned with the [AI Security Scanner](/xygeni-products/ai-security/ai-security-scanner.md)), the download reports an error asking for a re-scan. {% endhint %} The AI-BOM is also available from the **Download BOM** menu on the [All Assets](/xygeni-products/application-security-posture-management-aspm/inventory/all-assets.md) page, next to the SBOM (CycloneDX / SPDX) and CBOM exports. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.xygeni.io/xygeni-products/application-security-posture-management-aspm/inventory/ai-assets.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.