DEEPBOM

io.github.JunHwan-Kwon由 GitHub 帳號 JunHwan-Kwon 發布v2.5.0更新於 Oct 24, 2026

Browser-local and CLI static evidence for deployed AI model artifacts.

已驗證Streamable HTTP可網頁執行開發者工具安全與監控AI 與機器學習

概覽

AI 產生的概覽

DEEPBOM 對已部署的 AI 模型產物（如 ONNX、TFLite、GGUF、SafeTensors）進行靜態稽核，在不需上傳模型位元組的情況下產生證據、差異與 BOM 報告。

可以做什麼
DEEPBOM 是針對序列化 AI 模型產物的本機靜態分析器。它提供 deepbom_capabilities、deepbom_audit、deepbom_diff 與 deepbom_explain_rule，涵蓋圖結構、張量、量化、記憶體、相容性與 ML-BOM 證據。輸出包含人類可讀摘要、JSON、CycloneDX 1.7 與 SARIF 投影，以及圖與模型摘要檢視。結論會區分已觀測的產物事實、預測的相容性，以及匯入的執行階段證據。
適用情境
適合在模型變更審查、依宣告的正式介面驗證產物、將 BOM 與產物對帳，或發布前檢查量化、儲存與記憶體事實時使用。也適用於匯出流程、實驗追蹤，以及需要可重複靜態檢查的發布閘門。
執行需求
可作為本機程序透過 npm（Node.js 20 或更新版本）以 stdio 執行，也可連線遠端 Streamable HTTP 端點。未宣告驗證、環境變數或標頭。除非設定 DEEPBOM_MCP_ALLOWED_ROOTS，本機路徑僅限啟動目錄。原始碼建置需要 Rust，Python 通道需要 Python 3.9 或更新版本。
安裝前請注意
deepbom.org/mcp 與 deepbom.org/mcp/claude 遠端端點被描述為有界且不保留模型位元組，但機密或大型產物應改用本機 CLI 或 stdio 服務。除非明確提供 --allow-download，驗證器不會連線 npm。靜態結果無法證明執行階段行為、準確率或合規性，中介資料連線僅是宣告，並非經過驗證的溯源。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 DEEPBOM，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.github.JunHwan-Kwon%2Fdeepbom/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "deepbom": {
      "type": "http",
      "url": "https://deepbom.org/mcp"
    }
  }
}

README

DEEPBOM

DEEPBOM is a local static analyzer for deployed AI model artifacts. It audits serialized graph, tensor, quantization, memory, compatibility, and ML-BOM evidence without uploading model bytes.

It is a multi-format artifact-evidence producer, an external-interface contract verifier, and a bounded BOM-to-artifact reconciliation tool. It is not an official reference implementation, a complete BOM validator, or a regulatory compliance verifier.

The public source distribution covers TFLite, ONNX, GGUF, SafeTensors, Core ML, and bounded ExecuTorch artifacts. Findings distinguish observed and derived artifact facts from predicted compatibility, imported runtime evidence, and values that cannot be assessed statically.

Evidence IR

DEEPBOM Evidence IR is the common representation family: Artifact IR, Model IR, optional Weight IR, Activation IR, Training IR, Snapshot IR and Provenance IR. The draft specification includes a generated schema catalog, compatibility checks and public maintenance rules.

Search input → IR → output mappings or inspect the same versioned catalog on GitHub. It is a DEEPBOM-maintained specification, not an endorsed external standard. The artifact metadata route retains deepbom.provenance_ir.v1 and its provenance_ir selector. The additive Snapshot workflow uses typed deepbom.provenance_ir.v2 references for native states, dataset releases and configurations. Existing document hashes are preserved; retired names remain unsupported. See the migration rules.

For model-change reviews, use the synthetic two-population example and browser evidence review. Web, CLI, Node/Python SDK and local MCP use the same checks. External measurements remain external evidence; criteria satisfaction does not establish clinical suitability.

Quick start

For export pipelines, experiment tracking and release checks, see the new Node/TypeScript and Python SDK contract and three executable integration examples. The supported SDK begins with DEEPBOM 2.1.0; earlier npm 2.0.0 packages do not include this entry point. Install it with npm install [email protected].

Run the published CLI without cloning the repository (Node.js 20 or newer):

bash
npx deepbom audit "https://raw.githubusercontent.com/JunHwan-Kwon/deepbom/main/web/samples/gpu_partition_probe.onnx#sha256=82a2feef00eb6ab03d82f2b30cd17f4d826e2d8307cb059eccd6a0f3120059b2"

The pinned expected values and independent verifier are in examples/expected-output. Source builds require Rust and, for the Python channel, Python 3.9 or newer; maintainer setup is documented separately below.

Assistant integration

Install the repository-local Agent Skill after previewing the managed files:

bash
npx -y [email protected] integrate codexnpx -y [email protected] integrate codex --applynpx -y [email protected] integrate claude-codenpx -y [email protected] integrate claude-code --apply

The Skill lets a local agent select a contract-compatible analyzer for a supported deployment-artifact question. It does not create or call a hosted analysis server. See the agent setup guide, the machine-readable capability contract, and the independent engine/Agent/evidence version policy.

The installed Skill first checks DEEPBOM_BIN, its package-bundled analyzer, and a deepbom already on PATH. It accepts a runtime only after the declared deepbom.agent_contract.v2 and evidence contract match and its self-test binds the exact observed engine version. The verifier does not contact npm unless --allow-download is explicitly supplied. This keeps a blocked registry lookup from being mistaken for a failed artifact analysis.

For persistent tool-call access, run the same local analyzer as an MCP server over stdio:

bash
npx -y [email protected] mcp

It exposes deepbom_capabilities, deepbom_audit, deepbom_diff, and deepbom_explain_rule without uploading artifact bytes or using a hosted analysis endpoint. Audit calls default to a bounded human summary; detailed formats and large-model scan depth are explicit. Local paths are restricted to the launch directory unless DEEPBOM_MCP_ALLOWED_ROOTS is configured. Agent-facing usage guidance is in the DEEPBOM skill. Claude Desktop users can instead install the version-matched deepbom-2.5.0.mcpb asset from the corresponding GitHub Release. The bundle contains the same CLI and WASM bytes as the npm channel and asks the user to select the only local directory it may read.

For a single attachment in ChatGPT, connect the separately bounded Streamable HTTP endpoint at https://deepbom.org/mcp. Its browser component performs the analysis in the ChatGPT sandbox and returns a bounded, hash-bound result; the DEEPBOM service does not fetch or retain model bytes. This path is ready for developer-mode review, while public ChatGPT discovery remains subject to OpenAI review. See the ChatGPT integration guide. Use the local CLI or stdio MCP for confidential or large artifacts, package and sidecar closure, complete exports, and repeated automation.

For private testing on a Claude host that supports remote MCP Apps, add the separate https://deepbom.org/mcp/claude connector. It opens an explicit file picker inside the MCP App; it does not automatically read Claude attachments. The selected bytes remain in the browser sandbox while a bounded result is returned to the conversation. Public Claude discovery remains subject to Anthropic review. See the Claude integration guide and use the local MCPB or CLI when derived model facts must also remain local.

The repository root is also a portable Agent Plugins package: plugin.json identifies the Skill and mcp.json declares the bounded ChatGPT attachment endpoint. The compatibility manifest under .codex-plugin/ carries the same identity for clients that have not moved to the portable format. These files prepare installation and review; they do not imply a public directory listing or platform approval.

Account-owned ChatGPT, Claude, Codex, and search-indexing steps are kept in the agent distribution operations checklist.

For code-first model development, start with the Python candidate loop. It uses the shipped native APIs and distinguishes trainable-model workflows from the browser Structure IDE's source-bound graph proposals.

Verified 2.4.0 release channels expose the same analysis implementation. npm and the Linux x86-64 release wheel below are published; other native platforms and registry channels require their own release verification.

bash
npx [email protected] audit model.onnx --format cyclonedxnpx [email protected] audit model.onnx --format sarif --output deepbom.sarif --gate defectsdeepbom capabilities --compactdeepbom self-testdeepbom audit model.onnx --list-sections --compactdeepbom audit model.onnx --section quantization,memory --compactdeepbom explain-rule onnx.conv.output-shapepython -m pip install 'deepbom @ https://github.com/JunHwan-Kwon/deepbom/releases/download/channels-v2.4.0/deepbom-2.4.0-py3-none-linux_x86_64.whl'deepbom audit model.gguf --compactdeepbom verify model.tflite --contract production-interface.jsondeepbom verify model.onnx --bom supplied.cdx.json --render markdowndeepbom contract capture model.onnx -o baseline.interface-contract.jsondeepbom diff baseline.gguf candidate.gguf --tensors --render markdowndeepbom capabilities --format agent-textdeepbom explore model.tflitedeepbom placement model.tflite --profiles xnnpack_cpu,tflite_coreml_delegate,litert_qualcomm_qnndeepbom graph model.onnx --format json --output artifact-graph.jsondeepbom audit model.onnx --section model_ir --compactdeepbom visualize model.onnx --view all --orientation portrait -o model-views.zipdeepbom model-summary model.onnx --format tabledeepbom model-summary model.gguf --level storage --format markdowndeepbom audit model.onnx --conversion-receipt conversion-receipt.json --format cyclonedx

The default is a terminal-sized evidence summary. --json and --compact expose complete format evidence; --format envelope provides the canonical cross-format contract; CycloneDX 1.7 and OASIS SARIF 2.1.0 are standard projections. --policy-output records a hash-bound gate result when --fail-on is selected. --review-policy adds identity-scoped, expiring exceptions and keeps execution, coverage, and finding-policy states independent. See docs/CLI_AUTOMATION.md. The complete option inventory is generated from the executable in docs/CLI_REFERENCE.md.

CycloneDX 1.7 consumers should read the analyzed model from metadata.component and additional inventory members from components[]. DEEPBOM does not duplicate the BOM root into the additional-components array.

The graph JSON output includes the evidence-preserving deepbom.artifact_ir.v2 ledger and a deterministic deepbom.graph_ir.v1 visualization compatibility projection. Serialized graph, storage topology, architecture grouping, scoped quantization, static placement, and imported runtime evidence remain separate. Method 2.2.0 also preserves an optional, output-bound conversion receipt without promoting declared converter execution to observed evidence. It materializes exactly decoded TFLite subgraphs, ONNX nested graphs/local functions, and ExecuTorch primary plans without flattening conditional scopes. Runtime-node fusion is reconciled only from artifact-bound subject references or primary native op indices; names are never guessed. graph_ir.v1 remains primary-scope-only for legacy consumers. The v2 JSON Schema is published at docs/schemas/deepbom-artifact-ir-v2.schema.json and at https://deepbom.org/schemas/deepbom-artifact-ir-v2.schema.json. The conversion receipt schema is published at docs/schemas/deepbom-conversion-receipt-v1.schema.json.

The additive preview deepbom.model_ir.v1 projects those frozen artifact facts into a format-neutral program, logical-value, storage, binding, quantization, architecture, and static/runtime evidence vocabulary. It preserves source, dependency, deterministic display, and observed runtime order as different fields. visualize consumes only this IR and creates deterministic monochrome ISO A4 SVG pages, 300-DPI black-and-white PNG derivatives, caption sidecars, and a Word insertion manifest. These are traceable engineering documents, not standard-conformance or regulatory-approval determinations. See docs/MODEL_IR_V1.md.

model-summary is the shared Keras-summary-like projection for every supported adapter. It emits operation rows when a serialized program exists, storage rows for graphless weight containers, and an explicit identity-only result for safe envelopes. It never relabels serialized constants as trainable parameters or a deterministic display order as observed runtime. JSON consumers can use deepbom.model_summary.v1, published in docs/schemas/deepbom-model-summary-v1.schema.json.

Public product output uses CycloneDX 1.7.

verify compares the serialized external tensor ABI with a supplied, artifact-bound production declaration. diff uses the canonical deterministic multi-target TFLite deployment-delta ledger, and explore exposes the existing WASM redesign Pareto search without claiming trained-model accuracy. A strict custom TFLite target can be bound with --target-profile profile.json; the CLI records both the source-file SHA-256 and the resolved Rust profile SHA-256. Accelerator evidence is separate from that CPU cost profile. Source-pinned TFLite Core ML and LiteRT Qualcomm QNN profiles, Core ML MLComputePlan, Edge TPU and Qualcomm compiler reports, TensorRT parser/engine evidence, and NVIDIA host profiles use a shared staged binding without promoting static or compiled evidence to observed execution. placement compares any available profiles over one conserved graph ledger without inventing backend priority.

The Cargo launcher downloads only the engine matching its exact package version and platform from the corresponding immutable GitHub Release. It validates the release matrix, byte lengths, and SHA-256 digests before caching or execution.

Build the npm, standalone, Python, and Cargo launcher channels:

bash
npm run build:channelsnpm run check:public-package-boundarynpm run check:channels -- --no-build

Run the public correctness gates:

bash
npm run check:clinpm run check:cli-docsnpm run check:cli-automationnpm run check:formatsnpm run check:rust

The browser workbench is available at deepbom.org.

Evidence scope

Format maturity

Accepted extensions do not imply equal analytical depth. TFLite and ONNX have stable executable-graph contracts. GGUF and SafeTensors have stable container, storage, and architecture contracts but do not serialize an executable graph. Core ML and ExecuTorch analysis remains preview and fixture-bounded. The exact parser, graph, quantization, and placement status for every format is available from deepbom capabilities --compact under public_product_contracts.

FormatPublic static evidence
TFLiteFlatBuffer graph and tensor contracts, quantization arithmetic, weight integrity, memory projections, accumulator proofs, redesign candidates, and source-bounded delegation predictions
ONNXProtobuf graph, initializer and external-data contracts, symbolic shape inference, operation cost, Q/DQ and affine quantization, and provider-compatible evidence envelopes
GGUFContainer and tensor-directory integrity, quantization encoding inventory, architecture metadata, and bounded LLM memory scenarios
SafeTensorsTensor-directory and sharding integrity, configuration-bound architecture contracts, AWQ/GPTQ/HQQ/compressed-tensors metadata, and bounded LLM memory scenarios
Core MLNeuralNetwork and ML Program serialized graphs, tensor/weight encodings, deployment floor, and imported compute-plan evidence boundaries
ExecuTorchBounded ET12/FT01 plans, source-bound portable calls and processed payload identities, plus optional selected-build/backend/operator/binary attestation; execution remains external
GraphDef / SavedModelBounded serialized nodes, data/control dependencies, first-MetaGraph SignatureDef tensor contracts, and hash-bound package membership; no graph execution
Keras / PT2Bounded declarative config/JSON dependency graphs without object construction, pickle loading, lowering, native code, or runtime-order claims
HDF5 / PyTorch checkpointSafe-envelope, archive, storage-member, and pickle-risk inventory only; no object graph or executable-model claim

Static compatibility does not establish observed execution-provider assignment, device latency, task accuracy, clinical validity, or release readiness. Runtime claims require an identity-bound runtime capture.

The detailed format and accelerator boundary is maintained in docs/SUPPORT_MATRIX.md. Bugs can be reported without sharing model bytes using docs/MODEL_FREE_BUG_REPORTING.md.

Distribution boundary

This repository is generated from an exact reviewed allowlist. Private rulepack generators, hosted-service infrastructure, and unreleased research modules are not included. The enforceable boundary and export verification method are documented in docs/PUBLIC_PRIVATE_BOUNDARY.md.

License and citation

The public source and release-channel packages are licensed under the Apache License 2.0. Third-party model artifacts retain their declared licenses.

Please cite:

Kwon, J. (2026). DEEPBOM: Browser-Native Static Analysis of On-Device Neural Network Deployment Artifacts [Computer software]. Zenodo. https://doi.org/10.5281/zenodo.21834508

Optional metadata and OMOP connections

After inspecting a model, create a model-bound input with deepbom audit model.onnx --metadata-template omop -o metadata.json. Fill the selected OMOP 5.4/5.5 CDM_SOURCE row and institution/release identifiers, then use --metadata metadata.json --evidence-files ./evidence --section provenance_ir --json. A generic template connects non-OMOP datasets, cohorts, code, runs and reports through the same IR.

The Web Metadata workspace provides import, record creation, an interactive relationship diagram and JSON/CycloneDX downloads. Local MCP deepbom_audit accepts metadata_template, metadata and evidence_files; ChatGPT/Claude widgets share only explicitly requested counts and digests. Connections remain declarations: file hashes and reference consistency do not authenticate lineage or clinical suitability. See the OMOP guide and common IR contract.

來源：README.md，提交 e5cacd5

工具

7

deepbom_analyze_file

Analyze an AI model artifact

Use when the user asks to inspect, summarize, or visualize an attached TFLite, ONNX, GGUF, SafeTensors, Core ML, or ExecuTorch deployment artifact. Opens a browser-local analyzer, returns a hash-bound format-neutral Model IR table and static evidence summary, and provides deterministic document views without executing model code. Do not use for training checkpoints, measured latency, task accuracy, clinical validity, regulatory compliance, or actual runtime placement.

輸入參數file必填analysis_depth

deepbom_capabilities

Check DEEPBOM capabilities

Use before analysis when format support, privacy boundaries, or the difference between the ChatGPT and local DEEPBOM paths is unclear. Returns capability metadata only and does not inspect a file.

無需輸入參數。

deepbom_publish_analysis

Return a DEEPBOM analysis to chat

Receives one bounded browser-produced DEEPBOM result, validates its structure, and returns it to the conversation. This tool accepts analysis results, never model bytes.

輸入參數result必填

deepbom_publish_error

Return a DEEPBOM analysis error to chat

Receives one bounded browser-produced DEEPBOM error and returns a recovery action to the conversation. This tool accepts diagnostic text, never model bytes.

輸入參數error必填

deepbom_query_file

Inspect specific model evidence

Use for follow-up questions about an already identified attachment: inspect a layer by subject_ref, search or page through all operations, inspect findings, rank improvement investigations, inspect encoded activation fusion, compare source-pinned static delegate eligibility, or explicitly analyze weight distributions, channels, similarity, singular spectra, sparsity and quantization with section=weights and optional weight_view. Weight analysis reads payloads on demand with explicit decoder/budget coverage (128 MiB widget limit). Reuse the ChatGPT-authorized file and the exact SHA-256 from its previous DEEPBOM result. section=profiles lists available backend profiles; query.target selects only a TFLite CPU planning profile from capabilities. The browser computes the query from the shared Evidence IR and returns a bounded result; model bytes are not sent to DEEPBOM. Static candidate eligibility is not observed placement, speed, accuracy, or runtime fusion. Do not invent findings while browser_query_started is pending.

輸入參數file必填query必填analysis_depthexpected_sha256必填

deepbom_publish_query

Return requested model evidence to chat

Component-only: validates and returns a bounded Evidence IR query projection for the same attachment. No model bytes, state persistence, or runtime execution. Result digests establish consistency, not independent server attestation.

輸入參數result必填

deepbom_workflow_guide

Choose a DEEPBOM analysis workflow

Use to discover how to answer a model-analysis question across ChatGPT, the interactive deepbom.org workspace and the local CLI. Returns real query sections, visualization/export actions, explicit web continuation links, required inputs, CLI argument templates and evidence limits for weights, pruning investigation, comparison, BOM verification, metadata/OMOP, activation evidence, runtime, batch/CI and integrations. No attachment is required. This is guidance, not a completed analysis or local command execution. Prefer answering from existing evidence; inspect supported follow-ups with deepbom_query_file before offering web continuation for richer interaction. Website links transfer only a workflow ID, never model data.

輸入參數formatworkflow

版本歷史

12
  1. v2.5.0最新Oct 20, 2026
  2. v2.4.0Oct 12, 2026
  3. v2.3.0Oct 11, 2026
  4. v2.2.0Oct 9, 2026
  5. v2.1.0Oct 7, 2026
  6. v2.0.0Sep 29, 2026
  7. v1.109.0Sep 28, 2026
  8. v1.106.0Sep 22, 2026
  9. v1.105.0Sep 22, 2026
  10. v1.103.0Sep 17, 2026
  11. v1.102.0Sep 17, 2026
  12. v1.101.0Sep 16, 2026

評分

已滿足適用檢查項的 100%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分