AgentBOM

Authoring guide

Conventions

  • Use semantic versioning for metadata.agent.version.
  • Assign bomRef values when elements are referenced across the document.
  • Prefer serialNumber as a urn:uuid: for document identity.
  • Use x- prefixed fields for organization-specific extensions.

Do

  • Declare all models the agent can invoke, including guardrails and embeddings.
  • List MCP servers and external APIs with scopes and auth modes.
  • Classify data sources with sensitivity labels.

Don't

  • Omit required fields (bomFormat, specVersion, metadata.agent).
  • Use non-standard enum values — validate against the schema.
  • Put secrets or credentials in the AgentBOM document.