chock sbom — emit a CycloneDX AI-BOM from enforced state
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
Research direction
Start by reading the existing CLI command structure, how chock.lock records policy versions and hashes, and how adapters read .mcp.json and per-agent config. Then map which enforced-state components can be represented and tested; done means chock sbom --repo . --format cyclonedx emits valid, deterministic CycloneDX JSON, with an emitter-stability golden and a docs coverage row.
Written by the indexing model from the issue text.
Description
Problem
Agentic supply chain (OWASP ASI04) is now incident-backed: ClawHub's audit found 11.9% of skills malicious (341/2,857, Koi Security Feb 2026; Unit 42 added agentic financial-fraud skills Aug 2026), and MCP-server exposure keeps growing (Censys: 12,520 internet-accessible services). Buyers increasingly ask "what is actually running in this repo's agent stack?" — the AI-BOM question.
Standards exist: CycloneDX ML-BOM is ratified (v1.7 / ECMA-424 2nd Ed.), SPDX 3.0 has AI profiles, and an agent-level BOM (MCP servers, tools, prompts) is proposed in CycloneDX spec issue #895. Generic scanners (cdxgen's aibom workflow) guess from source.
Proposal
chock sbom — emit a CycloneDX AI-BOM derived from enforced state, not scanning:
- policies + versions + sha256 from
chock.lock(source, catalog provenance, trust tier) - MCP servers from committed agent config (
.mcp.jsonand per-agent equivalents the adapters already know) - installed skills (
.agents/skills/), compiled gates, adapters/surfaces in play - deterministic output (golden-stable), no secrets, no network
Differentiation is the derivation: every component in the BOM is something Chock pins or compiles, so the BOM states what is enforced to be present, not what a scanner guessed. Track CycloneDX #895 and align field names as it ratifies.
Fits wedge-line phase 5 (SLSA provenance, signed tags) — the BOM is the natural artifact those attestations attach to.
Acceptance sketch
chock sbom [--repo .] [--format cyclonedx]→ valid CycloneDX JSON, deterministic across runs- emitter-stability golden + docs page row in the coverage story
- claims follow the coverage taxonomy: BOM covers the chock-managed slice; native/unmanaged components are listed only when witnessable from committed config
- Dominant language
- Python
- Stars
- 8
- Forks
- 1
- Avg merge
- 2h 48m
- Merged PRs (30d)
- 121
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from open-coder-ai/chock
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
open-coder-ai/chock#238 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
open-coder-ai/chock#231 ·
Maintainers usually reply within 1 day
-
good first issue help wanted
Difficulty 2/5 Half a day Newbie friendliness 85/100
open-coder-ai/chock#133 ·
Maintainers usually reply within 1 day
-
good first issue
Difficulty 3/5 Half a day Newbie friendliness 68/100
open-coder-ai/chock#132 ·
Maintainers usually reply within 1 day
-
good first issue
Difficulty 5/5 Over a week Newbie friendliness 45/100
open-coder-ai/chock#131 ·
Maintainers usually reply within 1 day
All issues in open-coder-ai/chock
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
omegaup/omegaup#10353 · 1 comment ·
Maintainers usually reply within 5 days
-
bot-triaged module: LrScheduler module: optimizer triaged
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 1 day
-
documentation glm5 llm-model
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
vllm-project/vllm-ascend#19062 ·
Maintainers usually reply within 1 day
-
author-page correction
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
acl-org/acl-anthology#10496 · 1 comment ·
Maintainers usually reply within 1 day