Forty catalogued models with owner and jurisdiction already recorded, plus live resolution against the Hugging Face Hub for any model at all — and an advisory check on the loading stack for both.
Step 1
Only the model ID is required. Everything else either comes from the Hub, or is something the Hub structurally cannot know — jurisdiction and legal entity have no field in CycloneDX or SPDX and no registry publishes them. Arriving here from a catalogue model pre-fills those two.
The org/name path from the model's Hub URL.
Blank resolves the head and pins whatever SHA comes back.
The Hub gives an org handle, not a legal person.
Decides whether hosted use is an export. Goes in as a property.
The BOM subject.
Checked against the advisories locally. Nothing is sent anywhere.
If the live fetch is blocked, run the command below and paste the output. The result is identical.
Coverage
Every advisory in this tool sits in the SBOM and AIBOM overlap. That is the whole argument for merging them rather than filing an AIBOM and calling the job done.
Scoring
Twelve fields are scored. A field counts as present only if the upstream owner published it. A value supplied by the catalogue populates the BOM but does not score, and is tagged atlas:provenance:* to say so — otherwise the score would measure this catalogue's completeness rather than the vendor's.
| Field | Source | Path | Availability |
|---|---|---|---|
commit_sha | Hub API | model_info().sha | Always, if the repo resolves |
weight_file_hashes | Hub API | siblings[].lfs.sha256 | Almost always |
safe_serialization | Hub API | a .safetensors sibling exists | Usually |
model_architecture | Repo file | config.json → architectures | Usually |
parameter_count | Hub API | safetensors index total | Often |
declared_licence | Model card | YAML license | Usually |
pipeline_task | Model card | YAML pipeline_tag | Usually |
base_model | Model card | YAML base_model | Sometimes |
training_datasets | Model card | YAML datasets | Rarely published |
evaluation_results | Model card | model-index block | Rarely published |
owner_entity | Catalogue | this atlas | Always |
owner_jurisdiction | Catalogue | this atlas | Always |
Ten of the twelve fields require a live Hub call. Generated offline, only the two catalogue-sourced fields are present: 2 ÷ 12 = 16.67%, rounded to 17%. The uniform score is the tell — it measures the absence of a network call, not the models. Resolving live produces a spread.
Six fields describe a downloadable artefact. A hosted API model has no repository, no weight files and no config.json, so those cannot exist. Counting them as missing would imply a gap the vendor could close by publishing a file it will never have. They are reported as not applicable and excluded from the denominator.
Even fully resolved, almost nothing reaches 100%. training_datasets and evaluation_results are absent from most model cards because owners choose not to publish them. Expect roughly 75% for a well-documented model and 50% for a typical one. The score measures upstream disclosure, not the quality of your inventory.
Advisories
No CVE targets model weights. Weights are data, not executable software, so nothing is published against them. Every advisory below sits in the loader — the SBOM and AIBOM overlap.