# kosa8 ai bom

Write a CycloneDX 1.6 AI bill of materials for a sandbox, session or model

## Usage

```
kosa8 bom (--sandbox S | --session ID | --model M)
```

An AI bill of materials says what an AI workload was made of: the model,
by the SHA-256 of its weights, with its source, signature and approval; the
inference runtime; the MCP servers its agent was offered, used and refused;
and the signed policies in force.

--sandbox and --session read what the audit log recorded for that workload
(`kosa8 model serve` and `kosa8 mcp serve` with --sandbox/--session); --model
describes a stored model as it would be served now. Output is deterministic:
the same records give the same bytes, and there is no timestamp unless you
pass --timestamp.

## Flags

| Flag | Type | What it does | Default |
|---|---|---|---|
| `--model` | string | a stored model, by local name |  |
| `--out, -o` | string | write to this file instead of stdout |  |
| `--sandbox` | string | the sandbox the AI workload ran in |  |
| `--session` | string | an AI session id (from `kosa8 model serve` or `kosa8 mcp serve`) |  |
| `--timestamp` | string | RFC 3339 time for metadata.timestamp (default: none, so output is reproducible) |  |

---
Source: https://docs.kosa8.com/reference/ai-bom/