# DEEPBOM for Google Antigravity

Inspect AI deployment artifacts locally without executing model code. Get the full SHA-256, serialized structure, artifact defects, cautions, evidence gaps, and the limits of static analysis.

This community plugin connects **DEEPBOM 1.103.0** to **Google Antigravity CLI**. Plugin release: **1.0.0**. It is independently published by Jun-Hwan Kwon; it is not a Google-reviewed or Google-endorsed store listing.

## Install

Requirements: Node.js 20 or newer on `PATH`, and a signed-in [Antigravity CLI](https://antigravity.google/docs/cli/install/). Initial validation uses Antigravity CLI 1.2.5 on Linux. Windows and macOS installation commands are provided, but those hosts have not been tested.

Download **deepbom-antigravity-1.0.0.zip** from [the release page](https://github.com/JunHwan-Kwon/deepbom-antigravity/releases/tag/v1.0.0), extract it, and run:

```sh
node /path/to/extracted/deepbom/install.mjs --workspace /path/to/models
```

Replace the two paths with the extracted plugin directory and the model directory you want DEEPBOM to read. Quote paths containing spaces. The same command works in PowerShell with Windows paths. The archive includes the pinned DEEPBOM engine, so this installation does not need npm. Restart `agy`, then open `/mcp` to check the DEEPBOM server. The installer records the selected directory and your Node executable; it does not change tool approval settings.

For installation from source instead:

```sh
git clone https://github.com/JunHwan-Kwon/deepbom-antigravity.git
cd deepbom-antigravity
npm ci --ignore-scripts
node install.mjs --workspace /path/to/models
```

`agy` must be on `PATH` during installation; alternatively set `DEEPBOM_AGY_BINARY` to its executable path. Model access stays restricted to the chosen directory, including when you open another workspace. Re-run the installer to change that directory or after moving your Node installation. If you previously registered a separate `deepbom` server manually, remove that old registration with `agy mcp remove deepbom` before using the plugin to avoid duplicate tool definitions.

## Use

In a new Antigravity conversation:

```text
Use the deepbom-inspect skill to inspect ./model.onnx.
Report its full SHA-256, serialized structure, defects, cautions,
evidence gaps, and limitations.
```

The skill is also available as `/deepbom:deepbom-inspect`. The MCP server may appear as `deepbom_deepbom` because Antigravity namespaces plugin tools.

For a detailed operation table, add: `Include an operation table with output shapes.`

Supported artifact families include ONNX, TFLite, GGUF, SafeTensors, Core ML, and ExecuTorch. Support depends on artifact structure and available sidecars; ask `deepbom_capabilities` when unsure. Checkpoints requiring code execution are outside this workflow.

## Fewer repeated approvals

The skill selects `json-compact` with `section: "summary"`, which contains all finding categories. A normal report needs one audit; a detailed operation table may need one additional audit. It avoids requesting summary, full JSON, and envelope successively or launching Python/Bash just to reformat results.

Antigravity still controls permissions. When an approval dialog appears, you can remember approval for that individual DEEPBOM tool for the conversation or persist it. The plugin does not change your permission settings or disable approvals. Actual call counts and prompts depend on the host and your request.

In the recorded Linux host test, a normal ONNX report used **one audit, one MCP approval, and no Bash/Python calls**. This is a measured example, not a promise that all requests need one approval.

## Privacy and evidence boundaries

DEEPBOM reads model bytes in a local process and does not upload them to the DEEPBOM service. The selected tool result, which may include file names, hashes, tensor names, and findings, is sent to your Antigravity conversation and processed under your Google account's applicable terms. Do not equate local parsing with an offline AI conversation. Installation downloads the plugin and engine; explicitly requested remote artifacts may be downloaded by the engine into a local cache.

This plugin adds no analytics, browser identifiers, account collection, or hosted storage. It never executes model code. Static evidence does not establish runtime latency, hardware placement, accuracy, clinical validity, or regulatory compliance. See [DEEPBOM privacy](https://deepbom.org/privacy) and [support](https://deepbom.org/support).

## Update or remove

Install a newer release with `node /path/to/new/deepbom/install.mjs --workspace /path/to/models`, then restart Antigravity. This plugin does not silently update its pinned engine.

```sh
agy plugin uninstall deepbom
```

## Development and validation

```sh
npm ci --ignore-scripts
npm test
agy plugin validate .
npm run package
```

The test suite starts the packaged engine over MCP, checks selected summaries and detailed structure against fixture hashes, verifies a mismatched expected hash is rejected, and verifies that paths outside the workspace are refused. Packaging writes the self-contained plugin to `dist/deepbom`. See [VALIDATION.md](VALIDATION.md) for recorded host checks.

Licensed under Apache-2.0. The engine is maintained at [JunHwan-Kwon/deepbom](https://github.com/JunHwan-Kwon/deepbom).