AI BOM MCP
The AI BOM MCP server provides tools to generate, audit, and map AI Bills of Materials (AI-BOMs) for compliance and governance purposes.
Generate AI-BOMs: Create structured AI-BOM documents in CycloneDX ML-BOM or SPDX 3.0 format covering all 10 required field categories, including model name, version, organisation, licence, architecture, parameter count, and training datasets.
Audit AI-BOM Completeness: Analyse an existing AI-BOM JSON document against the 10 required field categories, returning per-category pass/fail results and a gap list of missing or incomplete fields.
Map to Regulation: Map an AI-BOM against regulatory framework requirements, supporting EU AI Act, NIST AI RMF, US EO 14028, and ISO 42001.
List Required Fields: Retrieve the full list of the 10 required AI-BOM field categories and their associated fields as a compliance reference.
Signed Attestations (Pro/Enterprise only): Generate cryptographically signed (HMAC-SHA256) AI-BOM completeness attestations with a unique ID and public verification URL for independent auditor verification.
Generates AI-BOMs in SPDX 3.0 format, providing a standard way to document AI software bill of materials.
Ai Bom MCP
Buy Starter — £29/mo
Signed attestations + unlimited audits + email support. 👉 Subscribe at meok.ai — instant HMAC signing key + Stripe-managed billing.
Free tier remains MIT-licensed and zero-config. Upgrade only when you need signed compliance artefacts for audit.
MCP server for ai bom mcp operations
Quick Install
Client | Install |
Claude Desktop | |
Cursor | |
VS Code | |
Windsurf | |
Docker |
|
pip |
|
Overview
Ai Bom MCP provides AI-powered tools via the Model Context Protocol (MCP).
Tools
Tool | Description |
| Generate an AI-BOM in CycloneDX ML-BOM format (or SPDX 3.0) with all 10 required |
| Audit an existing AI-BOM for completeness against the 10 required field categori |
| Map an AI-BOM against a specific regulatory framework's technical documentation |
| List the 10 required AI-BOM field categories and their fields. |
| Generate a cryptographically signed AI-BOM completeness attestation (Pro/Enterpr |
Installation
pip install meok-ai-bom-mcpUsage with Claude Desktop
Add to your Claude Desktop MCP config (claude_desktop_config.json):
{
"mcpServers": {
"ai-bom-mcp": {
"command": "python",
"args": ["-m", "meok_ai_bom_mcp.server"]
}
}
}Usage with FastMCP
from mcp.server.fastmcp import FastMCP
# This server exposes 5 tool(s) via MCP
# See server.py for full implementationWire it up — full stack
Pair this with the MEOK chain that turns one agent action into ONE signed compliance event:
bft-progress-council-mcp — anti-loop guardrail
agent-token-budget-mcp — hard spend cap
agent-prompt-injection-firewall-mcp — OWASP LLM01 scan
agent-audit-logger-mcp — hash-chained evidence
a2a-governance-bridge-mcp — fold N attestations → 1 signed event
agent-incident-relay-mcp — broadcast incidents to 5 regimes simultaneously
See meok.ai/mcp-stack for the full architecture and meok.ai/mcp-stack/demo for the live in-browser demo.
License
MIT © MEOK AI Labs
<<<<<<< Updated upstream
Stashed changes
Sister MCPs
Part of the MEOK Governance pack — designed to work together as a fleet. Install the whole pack with npx meok-setup --pack governance, or pick the ones you need:
Cyber Resilience Act →
uvx cra-compliance-mcp· PyPI · GitHubAI Incident Reporting →
uvx ai-incident-reporting-mcp· PyPI · GitHubDORA × NIS2 Crosswalk →
uvx dora-nis2-crosswalk-mcp· PyPI · GitHub
Full catalogue + Anthropic Registry verify links: meok.ai/anthropic-registry
Protocol coverage + Universal PAYG
This MCP is part of MEOK's 47-MCP fleet that bridges every active agent-interop protocol and 30+ regulatory frameworks. See the full coverage matrix at meok.ai/protocols.
Agent interop protocols supported (8 live):
✅ MCP (Anthropic) — native
✅ A2A (Google + Linux Foundation, absorbed IBM ACP Sept 2025)
✅ IBM ACP — covered via A2A merge
◐ Stripe ACP (Agentic Commerce Protocol) — Q3 bridge via agent-commerce-protocol-mcp
◐ AP2 (Google Agent Payments) — partial via agent-commerce-payments-mcp
◐ x402 (Coinbase HTTP 402) — partial via api.meok.ai gateway
→ OASF / AGNTCY (Cisco Outshift + Linux Foundation) — Q3 bridge
👁 ANP (Cisco Agent Network) — watch-list
Pricing options:
Option | Price | Best for |
Self-host (this MCP) | £0 — MIT | Devs |
This MCP Starter | £29/mo | One-MCP teams |
This MCP Pro | £79/mo | Production + 24h SLA |
£29/mo + £0.0002/call | Spiky usage across many MCPs | |
Substrate bundle (this category) | £99-£499/mo | A whole pack |
£1,499/mo | All 47 MCPs, 500K calls |
Each tier above the free self-host adds HMAC-signed attestations verifiable at
verify.meok.ai. Linux Foundation governance on the A2A spine means EU regulated
buyers can deploy without vendor-lock-in objections.
Maintenance
Latest Blog Posts
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/CSOAI-ORG/ai-bom-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server