"github.com/snyk/cli-extension-ai-bom/pkg/aibom"

globalEngine.AddExtensionInitializer(aibom.Init)

github.com/snyk/cli-extension-ai-bom v0.0.0-20250507092905-796fa7472681

github.com/snyk/cli-extension-ai-bom v0.0.0-20250507092905-796fa7472681 h1:Mdj0YYq6oJzRdbnYzlbEMxeOp/c4MxuZfN8TDAXxz44=

github.com/snyk/cli-extension-ai-bom v0.0.0-20250507092905-796fa7472681/go.mod h1:5a+N7XhF3sd6Qy7hwQvSWyHrkfp2/J556SLjPdbyDbE=

go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=

go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=

import os

import anthropic

from anthropic import Client

def init() -> tuple[Client, str]:

key = "ANTHROPIC_API_KEY"

if key not in os.environ:

print(f"{key} not set in environment.")

exit(1)

client = anthropic.Anthropic()

return client, "claude-3-5-sonnet-20240620"

def main() -> None:

client, model = init()

while True:

prompt = input("> ")

if prompt == "exit":

break

response = client.messages.create(

model=model,

max_tokens=1024,

messages=[{"role": "user", "content": prompt}],

)

print(response.content[0].text)

if __name__ == "__main__":

main()

{

"$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",

"version": "2.1.0",

"runs": [

{

"results": [

{

"ruleId": "",

"ruleIndex": 0,

"level": "",

"message": {

"text": "{\"$schema\":\"https://cyclonedx.org/schema/bom-1.6.schema.json\",\"bomFormat\":\"CycloneDX\",\"components\":[{\"bom-ref\":\"application:Root\",\"name\":\"Root\",\"type\":\"application\"},{\"bom-ref\":\"pkg:anthropic\",\"evidence\":{\"identity\":[{\"field\":\"name\",\"methods\":[{\"confidence\":0.9,\"technique\":\"source-code-analysis\"}]}],\"occurrences\":[{\"line\":8,\"location\":\"chatbot.py\",\"offset\":8},{\"line\":9,\"location\":\"chatbot.py\",\"offset\":23},{\"line\":17,\"location\":\"chatbot.py\",\"offset\":14}]},\"name\":\"anthropic\",\"type\":\"library\"},{\"bom-ref\":\"model:claude-3-5-sonnet-20240620\",\"evidence\":{\"identity\":[{\"field\":\"name\",\"methods\":[{\"confidence\":0.9,\"technique\":\"source-code-analysis\"}]}],\"occurrences\":[{\"line\":27,\"location\":\"chatbot.py\",\"offset\":20}]},\"externalReferences\":[{\"type\":\"website\",\"url\":\"https://docs.anthropic.com/en/docs/about-claude/models/all-models#model-comparison-table\"}],\"manufacturer\":{\"name\":\"Anthropic PBC\",\"url\":[\"https://www.anthropic.com\"]},\"name\":\"claude-3-5-sonnet-20240620\",\"type\":\"machine-learning-model\"}],\"dependencies\":[{\"dependsOn\":[\"pkg:anthropic\",\"model:claude-3-5-sonnet-20240620\"],\"ref\":\"application:Root\"}],\"specVersion\":\"1.6\",\"version\":1}",

"markdown": "",

"arguments": []

},

"locations": [],

"fingerprints": {},

"codeFlows": []

}

],

"properties": {

"coverage": []

}

}

]

}

import { runSnykCLI } from '../../util/runSnykCLI';

import { fakeServer } from '../../../acceptance/fake-server';

import { getServerPort } from '../../util/getServerPort';

import { resolve } from 'path';

import { fakeDeepCodeServer } from '../../../acceptance/deepcode-fake-server';

jest.setTimeout(1000 * 60 * 5);

describe('snyk aibom (mocked servers only)', () => {

let server: ReturnType<typeof fakeServer>;

let deepCodeServer: ReturnType<typeof fakeDeepCodeServer>;

let env: Record<string, string>;

const port = getServerPort(process);

const baseApi = '/api/v1';

const initialEnvVars = {

...process.env,

SNYK_API: 'https://localhost:' + port + baseApi,

SNYK_HOST: 'https://localhost:' + port,

SNYK_TOKEN: '123456789',

};

const projectRoot = resolve(__dirname, '../../../..');

const pythonChatbotProject = resolve(

projectRoot,

'test/fixtures/ai-bom/python-chatbot',

);

beforeAll(() => {

return new Promise<void>((resolve, reject) => {

try {

let serversReady = 0;

const totalServers = 2;

const checkAndResolve = () => {

serversReady++;

if (serversReady === totalServers) {

resolve();

}

};

deepCodeServer = fakeDeepCodeServer();

deepCodeServer.listen(checkAndResolve);

env = {

...initialEnvVars,

SNYK_CODE_CLIENT_PROXY_URL: `https://localhost:${deepCodeServer.getPort()}`,

};

server = fakeServer(baseApi, 'snykToken');

deepCodeServer.setFiltersResponse({

configFiles: [],

extensions: ['.py'],

autofixExtensions: [],

});

const sarifPayload = require('../../../fixtures/ai-bom/sample-ai-bom-sarif.json');

deepCodeServer.setSarifResponse(sarifPayload);

server.listen(port, checkAndResolve);

} catch (error) {

reject(error);

}

});

});

afterEach(() => {

jest.resetAllMocks();

server.restore();

deepCodeServer.restore();

});

afterAll(() => {

return new Promise<void>((resolve) => {

deepCodeServer.close(() => {

server.close(() => {

resolve();

});

});

});

});

test('`aibom` generates an AI-BOM CycloneDX with components', async () => {

const { code, stdout } = await runSnykCLI(

`aibom ${pythonChatbotProject} --experimental`,

{

env,

},

);

let bom: any;

expect(code).toEqual(0);

expect(() => {

bom = JSON.parse(stdout);

}).not.toThrow();

expect(bom).toMatchObject({

$schema: 'https://cyclonedx.org/schema/bom-1.6.schema.json',

specVersion: '1.6',

bomFormat: 'CycloneDX',

});

expect(bom.components.length).toBeGreaterThan(1);

});