# DEEPBOM

> Model analysis and evidence for AI deployment. DEEPBOM identifies a model
> artifact by hash, records what its serialized contracts actually state, and
> keeps static derivations, target assumptions, and imported runtime
> observations separate so each claim carries its own evidence class.

Analysis runs locally, in the reader's browser or CLI process. The ChatGPT
integration also analyzes an authorized attachment inside its browser sandbox.
The separate Claude remote MCP App requires an explicit file selection inside
the app; it does not automatically read Claude attachments. The local Claude
Desktop extension is the preferred path for confidential, large, or package artifacts.
The remote MCP control plane serves tool metadata and validates the bounded
result; it does not fetch or retain model bytes.

## Use cases

Deployment review, optimization review, and release comparison share the same
artifact analysis and evidence workflow. SaMD development is an application
of that workflow: https://deepbom.org/evaluate/regulatory/#samd-deployment
Technical artifact evidence does not establish clinical validity or regulatory approval.

## Command line

Prefer a verified exact-version installation. The Agent Skill's
`scripts/verify-deepbom.mjs` checks local candidates without contacting a
registry. Its `--allow-download` fallback is explicit and may use npm.

```
npx -y deepbom@2.5.0 capabilities --format agent-json
npx -y deepbom@2.5.0 self-test --compact
npx -y deepbom@2.5.0 audit model.tflite --summary
npx -y deepbom@2.5.0 verify model.onnx --bom supplied.cdx.json --render markdown
npx -y deepbom@2.5.0 contract capture model.onnx -o baseline.interface-contract.json
npx -y deepbom@2.5.0 explain-rule <rule-id> --json
```

Python facade:
```python
from deepbom import audit, tensors, verify_bom, capture_contract
result = audit("model.onnx")
```

For tool-call access instead of shell invocation, `npx -y deepbom@2.5.0 mcp` speaks the
Model Context Protocol over stdio and exposes `deepbom_capabilities`,
`deepbom_audit`, `deepbom_diff`, and `deepbom_explain_rule`. It runs locally
on the same terms. A plain chat without shell or local MCP access cannot run
local-file analysis. A connected DEEPBOM ChatGPT plugin can analyze one
authorized attachment in its browser sandbox and return a bounded result.
Remote MCP endpoint: https://deepbom.org/mcp
Claude remote host-test endpoint: https://deepbom.org/mcp/claude

Formats: .tflite, .onnx, .gguf, .safetensors, .mlmodel, .pte, .ptd.
Outputs: analysis JSON, evidence envelope, CycloneDX 1.7, SARIF 2.1.0.
Exit codes: 0 pass, 1 invocation or analysis failure, 2 policy or verification
block, 3 incomplete verification binding, 4 independently supplied artifact
SHA-256 mismatch.

## Reading a result

Findings carry three distinct kinds and must not be merged. `artifact_defect`
is a problem in the artifact. `caution` is something a reviewer should look
at. `evidence_gap` is a claim the artifact cannot settle on its own, such as
runtime placement or measured latency; it is not a defect, and closing it
needs an imported runtime, lineage, or build-evidence document. The browser
review summary reports the same group under the field name
`evidence_needed`. Static output never establishes executed accelerator
assignment, latency, energy, accuracy, or device fit.

## Pages

- [Workspace](https://deepbom.org/): browser-local audit of one artifact
- [Downloads and setup](https://deepbom.org/get-started/): Windows, macOS, Linux, CLI installation, and AI connections with availability status
- [CLI Handbook](https://deepbom.org/guides/cli/): practical audit, export, visualization, diff, verification, CI, batch, and local MCP workflows
- [CLI command reference](https://deepbom.org/guides/cli/reference/): executable-generated command inventory, output contracts, and complete option help
- [AI agent setup](https://deepbom.org/for-agents/): local Agent Skill, npx, and stdio MCP paths
- [ChatGPT integration](https://deepbom.org/chatgpt/): attached-file analysis in the ChatGPT browser sandbox
- [Claude integration](https://deepbom.org/claude/): separate local Desktop and browser-local remote paths
- [Inspection guides](https://deepbom.org/guides/): problem-focused ONNX, GGUF, and artifact-diff workflows
- [Evidence IR](https://deepbom.org/guides/evidence-ir/): common IR family, schemas, compatibility and evidence boundaries
- [Compatibility explorer](https://deepbom.org/guides/evidence-ir/compatibility/): versioned input-to-IR and IR-to-output mappings, schemas and implementation references
- [Evaluate DEEPBOM](https://deepbom.org/evaluate/): choose an engineering, quality, or regulatory evaluation brief
- [Regulatory brief](https://deepbom.org/evaluate/regulatory/): what the records can support in a controlled process, and where they stop
- [Quality brief](https://deepbom.org/evaluate/quality/): validating an installed analyzer before relying on it
- [Engineering brief](https://deepbom.org/evaluate/engineering/): architecture, CI entry point, and what it will not infer
- [Report verifier](https://deepbom.org/verify): check a generated report against its artifact

## Project

- Source: https://github.com/JunHwan-Kwon/deepbom (Apache-2.0)
- Record: https://doi.org/10.5281/zenodo.21834508
- Author: Jun-Hwan Kwon, Ph.D. (ORCID 0000-0002-6464-3895)
- Agent skill file: https://deepbom.org/skills/deepbom/SKILL.md
- Claude Desktop extension: https://github.com/JunHwan-Kwon/deepbom/releases/download/channels-v2.5.0/deepbom-2.5.0.mcpb