OptimaTrust

Supply chain

AI bill of materials

Versioned AI BOM snapshots with CycloneDX and SPDX export from stored components.

Each BOM snapshot records the models, datasets, tools, MCP servers, and vendors bound to an asset at a point in time. Exports follow CycloneDX 1.5 and SPDX 2.3 from stored components. A BOM is evidence of composition — not a certified CVE feed.

Outcomes

  • Point-in-time composition of an AI system
  • Exportable SBOM-class artifacts
  • Supply-chain dimension on the assurance score

All capabilities

Trusted AI. Assured future.

See OptimaTrust test the systems you actually run.

Bring an agent API, a model endpoint, or a shadow-AI list. We will show registry, labs, score deductions, and evidence — not a GRC slide deck.