`maqpna aibom`

Export the AI bill of materials (CycloneDX or SPDX) of agents, models and tools

Observe-o json | yaml

Synopsis#

maqpna aibom [--system all|NS/AGENT|namespace:NS|tenant:NAME] [--format cyclonedx|spdx] [--spec-version 1.6|1.7]
                   [-f FILE|DIR]... [--ledger FILE | --gateway URL] [--since 30d|RFC3339] [--until RFC3339] [--no-cluster] [--out FILE]

Description#

Builds the AI-BOM of a governed AI system:

  agents        Agent: image (digest -> purl and SHA-256), framework (annotation
                or label maqpna.com/framework), trust tier, isolation, policy
  models        spec.model and its fallbacks, plus models observed in the
                ledger's metered usage (calls, input and output tokens)
  MCP servers   MCPServer: host, trust, jurisdiction, data class, tool pins
                (SHA-256 of each tool definition) and observed definitions
  A2A peers     A2APeer (and peers called in the ledger)
  memory        MemoryStore: backend, jurisdiction, TTL, DLP, agents
  policies      ToolPolicy (spec SHA-256) and the gateway policy bundle

and their dependencies. MAQPNA facts are CycloneDX properties named maqpna:*.

Live mode reads the cluster (as 'maqpna evidence generate' does) and the ledger from the gateway (--gateway or the context) or --ledger. Offline mode (-f) reads the same objects from YAML or JSON files or directories (kubectl get -o yaml output or manifests) and, with --ledger, a ledger file; the gateway is only used offline when --gateway is passed explicitly. The output has configuration and counts only: no prompts, arguments or user identities.

Flags#

Flag	Type	Description	Default
`--allow-gateway-mismatch`	switch	send the context's login token to a gateway other than the one it was issued for (env MAQPNA_ALLOW_GATEWAY_MISMATCH=1)	none
`-f`, `--filename`	string	YAML/JSON file or directory with MAQPNA objects (repeatable; offline mode)	none
`--format`	string	cyclonedx \| spdx (SPDX 3.0.1 JSON-LD, AI profile)	`cyclonedx`
`--gateway`	string	gateway base URL (env MAQPNA_GATEWAY_URL; default: the context's gateway)	none
`--ledger`	string	audit ledger file for observed models, tools and A2A calls	none
`--no-cluster`	switch	do not read the cluster (with neither -f nor the cluster, components come from the ledger only)	none
`--oidc-token-file`	string	file holding an OIDC access token for the admin API (env MAQPNA_OIDC_TOKEN_FILE); wins over `--token`	none
`--out`	string	output file (default stdout)	none
`--since`	string	observed usage from: a duration ago (720h; 30d) or an RFC3339 time	`30d`
`--spec-version`	string	CycloneDX spec version: 1.6 \| 1.7	`1.6`
`--system`	string	all, NS/AGENT (agent), namespace:NS or tenant:NAME	`all`
`--token`	string	static admin token (env MAQPNA_ADMIN_TOKEN; dev/break-glass)	none
`--until`	string	observed usage until (RFC3339; default now)	none

The global flags (--context, -o, --no-color, ...) work with every command.

Examples#

$ maqpna aibom --gateway "$GW" --system namespace:team-a --out team-a.cdx.json
$ maqpna aibom -f objects.yaml --ledger audit.jsonl --spec-version 1.7 --out aibom.cdx.json
$ maqpna aibom -f manifests/ --format spdx --no-cluster

What happens when you run it#

Talks to the gateway: --gateway, else MAQPNA_GATEWAY_URL, else the current context's gateway (maqpna context).
Authenticates to the admin API with the token stored by maqpna login, --oidc-token-file, or a static --token (MAQPNA_ADMIN_TOKEN).
Reads the audit ledger offline with --ledger FILE: audit ledger file for observed models, tools and A2A calls.
Prints a table by default; -o json or -o yaml print the data, and --jq EXPR filters the JSON.

Exit codes#

Code	Meaning
`0`	success
`1`	error (the message says what failed, with a hint when there is one)
`2`	usage error: unknown flag, missing argument or bad value; the synopsis is printed
`3`	a check failed, a change is blocked, or a result did not match (tamper, policy mismatch) (not used by this command)

maqpna aibom