nuguardai/nuguard/sbom-analysis

Read and interpret NuGuard AI-SBOM files to answer questions about an AI application's components and attack surface.

SBOM shape

{
  "schema_version": "1.4.0",
  "generated_at": "<ISO timestamp>",
  "target": "<repo or source path>",
  "nodes": [ ... ],   // AI components
  "edges": [ ... ],   // directed relationships between components
  "deps": [ ... ],    // Python/JS package dependencies
  "summary": { ... }  // high-level scan summary
}

Node types

Edge types

CALLS (agent → tool/model), ACCESSES (component → datastore, with access_type: read/write/readwrite), GUARDED_BY (component filtered by a guardrail), USES_AUTH, EXPOSES (service → endpoint).

A path AGENT → CALLS → TOOL → ACCESSES → DATASTORE with no GUARDED_BY edge on the TOOL is a structural risk (NGA-001, or NGA-009 if the datastore holds PII/PHI).

Answering common questions

• "What AI components does this app use?" List nodes grouped by component_type; for

each AGENT, name its connected TOOL/MODEL nodes from CALLS edges.

• "Is this app secure?" Don't judge from the SBOM alone — run

nuguard analyze --sbom <path> and explain that structural graph checks are more reliable than manual reading.

• "What data does this app access?" Find DATASTORE nodes; report

data_classification, access_type from ACCESSES edges, and whether an auth node sits in the path.

• "Does this app have guardrails?" Find GUARDRAIL nodes and check whether CALLS or

GUARDED_BY edges connect them to agents/tools.

• "What frameworks does this app use?" Check summary.frameworks and the framework

field on AGENT/PIPELINE/CHAIN nodes.

Risk signals to flag directly from the SBOM

Flag these even without running nuguard analyze:

• Any TOOL with sql_injectable: true or ssrf_possible: true
• Any DATASTORE with PII/PHI classification and no reachable auth node
• Any MCP_SERVER with trust_level: untrusted
• Any AGENT with injection_risk_score > 0.7
• Any API_ENDPOINT with no_auth_required: true and a write-capable HTTP method
• A system_prompt_excerpt containing instruction-like phrases fetched from an external

source (indirect injection surface)