AgentBOM

OPEN STANDARD · v1 · Apache-2.0

The open standard for declaring what an AI agent is made of.

AgentBOM is a vendor-neutral, machine-readable format for describing an agent's models, tools, skills, data access, and permissions — so they can be reviewed, signed, verified, and audited across organizations.

Read the specTry the verifier
{
  "bomFormat": "AgentBOM",
  "specVersion": "1.0",
  "metadata": {
    "agent": {
      "name": "Support Triage Agent",
      "version": "1.0.0",
      "type": "copilot",
      "autonomyLevel": "act-with-approval"
    }
  },
  "models": [
    {
      "role": "primary",
      "provider": "self-hosted",
      "name": "qwen2.5-32b-awq"
    }
  ]
}

Why a bill of materials for agents

Open & neutral

JSON Schema, Apache-2.0, governed in the open. No vendor lock, no required platform.

Verifiable

A single dependency-free verifier validates structure, integrity, and signatures. Deterministic output, runs anywhere — including your CI and your browser.

Built for governance

Maps cleanly to existing supply-chain and AI-governance obligations (SBOM, EU AI Act, RBI FREE-AI) instead of inventing a parallel regime.

What an AgentBOM declares

  • Identity & version of the agent
  • Models used (provider, model id, version, hosting/region)
  • Tools & connectors (incl. MCP servers, scopes)
  • Skills / capabilities
  • Data access (sources, classifications, retention)
  • Permissions & autonomy level
  • Provenance & signatures

How it fits

AgentBOM is the declarative layer: what an agent is composed of. Runtime audit artifacts (Trust Receipts) and governance tooling reference it. The format is open so producers and consumers never have to share a vendor — only a schema.

AgentBOM questions and answers

What is AgentBOM?

AgentBOM, or Agent Bill of Materials, is an open, vendor-neutral, machine-readable format for declaring what an AI agent is made of. It records models, tools, skills, data access, permissions, provenance, and signatures in a portable JSON document.

Why do AI agents need a bill of materials?

AI agents combine models, tools, data, and permissions that can change independently. A bill of materials creates a reviewable inventory so security, compliance, procurement, and engineering teams can understand and verify an agent before deployment.

How is AgentBOM different from an SBOM?

An SBOM inventories software components and dependencies. AgentBOM complements SBOM formats by describing AI-specific composition and authority, including models, tools, skills, data access, permissions, autonomy, provenance, and signatures.

Is AgentBOM tied to a vendor or platform?

No. AgentBOM is a vendor-neutral open standard based on JSON Schema. Producers and consumers can use different platforms as long as they exchange documents that conform to the published schema.

How do I validate an AgentBOM document?

Validate it against the canonical AgentBOM v1 JSON Schema. You can use the browser verifier on this site or the dependency-free @agentbom/verify package in applications and CI pipelines.

Ready to implement it? Follow the quickstart or review the normative specification.

Get involved

AgentBOM is an open standard maintained in public. Read the governance model, open an issue, or propose a change. Read governance →