Agent SBOM and Supply Chain Assessment
The AI Bill of Materials as a supply-chain security tool. An agent is a dependency graph with a model at the center, and every tool, every MCP server, every checkpoint, and every training corpus is a trust dependency an attacker can reach. Covers the SBOM-to-AI-BOM extension (software bill of materials to AI bill of materials including the model, training data, tools/MCP servers, dependencies), the assessment tools and methodologies (CycloneDX ML/AI and crypto-material extensions, SPDX AI/SAI profiles, NTIA minimum elements), how an agent's supply chain is its attack surface (every trust dependency is a vector for the injection/exfiltration/governance-bypass attacks of B1-B5 and SDD-B04-B06), and the generation and validation practice. Expands B4's supply-chain material and B11's governance material into concrete supply-chain assessment.
Every component in the AI BOM is a trust dependency an attacker can reach. The model is reachable via the prompt channel; the tools via tool-call manipulation; the MCP servers via the agent's outbound connections; the training data retroactively via poisoning. A component not in the BOM is a surface not assessed.
The AI BOM is the SBOM extended to the model, data, and tool supply chain. It enumerates the model, the training data sources, every tool, every MCP server, the fine-tune adapters, the quantization, and the runtime. A BOM that declares the model name but omits the tools and MCP components has missed the parts of the supply chain that ARE the attack surface.
An AI BOM that does not match the runtime is worse than no BOM. Undeclared components are unassessed surfaces; a BOM that drifts from the deployed system gives false assurance. The BOM must be machine-generated from the running system and re-validated on every deployment.