Allows Google Antigravity users to inspect AI deployment artifacts locally with DEEPBOM, returning SHA-256, serialized structure, defects, cautions, evidence gaps, and static analysis limitations for supported formats such as ONNX, TFLite, GGUF, SafeTensors, Core ML, and ExecuTorch.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@deepbom Inspect ./model.onnx and report its SHA-256, structure, and defects."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Inspect AI deployment artifacts locally without executing model code. Get the full SHA-256, serialized structure, artifact defects, cautions, evidence gaps, and the limits of static analysis.
This community plugin connects DEEPBOM 1.103.0 to Google Antigravity CLI. Plugin release: 1.0.0. It is independently published by Jun-Hwan Kwon; it is not a Google-reviewed or Google-endorsed store listing.
Requirements: Node.js 20 or newer on PATH, and a signed-in Antigravity CLI. Initial validation uses Antigravity CLI 1.2.5 on Linux. Windows and macOS installation commands are provided, but those hosts have not been tested.
Download deepbom-antigravity-1.0.0.zip from the release page, extract it, and run:
node /path/to/extracted/deepbom/install.mjs --workspace /path/to/modelsReplace the two paths with the extracted plugin directory and the model directory you want DEEPBOM to read. Quote paths containing spaces. The same command works in PowerShell with Windows paths. The archive includes the pinned DEEPBOM engine, so this installation does not need npm. Restart agy, then open /mcp to check the DEEPBOM server. The installer records the selected directory and your Node executable; it does not change tool approval settings.
For installation from source instead:
git clone https://github.com/JunHwan-Kwon/deepbom-antigravity.git
cd deepbom-antigravity
npm ci --ignore-scripts
node install.mjs --workspace /path/to/modelsagy must be on PATH during installation; alternatively set DEEPBOM_AGY_BINARY to its executable path. Model access stays restricted to the chosen directory, including when you open another workspace. Re-run the installer to change that directory or after moving your Node installation. If you previously registered a separate deepbom server manually, remove that old registration with agy mcp remove deepbom before using the plugin to avoid duplicate tool definitions.
Related MCP server: TaskBounty Check
In a new Antigravity conversation:
Use the deepbom-inspect skill to inspect ./model.onnx.
Report its full SHA-256, serialized structure, defects, cautions,
evidence gaps, and limitations.The skill is also available as /deepbom:deepbom-inspect. The MCP server may appear as deepbom_deepbom because Antigravity namespaces plugin tools.
For a detailed operation table, add: Include an operation table with output shapes.
Supported artifact families include ONNX, TFLite, GGUF, SafeTensors, Core ML, and ExecuTorch. Support depends on artifact structure and available sidecars; ask deepbom_capabilities when unsure. Checkpoints requiring code execution are outside this workflow.
The skill selects json-compact with section: "summary", which contains all finding categories. A normal report needs one audit; a detailed operation table may need one additional audit. It avoids requesting summary, full JSON, and envelope successively or launching Python/Bash just to reformat results.
Antigravity still controls permissions. When an approval dialog appears, you can remember approval for that individual DEEPBOM tool for the conversation or persist it. The plugin does not change your permission settings or disable approvals. Actual call counts and prompts depend on the host and your request.
In the recorded Linux host test, a normal ONNX report used one audit, one MCP approval, and no Bash/Python calls. This is a measured example, not a promise that all requests need one approval.
DEEPBOM reads model bytes in a local process and does not upload them to the DEEPBOM service. The selected tool result, which may include file names, hashes, tensor names, and findings, is sent to your Antigravity conversation and processed under your Google account's applicable terms. Do not equate local parsing with an offline AI conversation. Installation downloads the plugin and engine; explicitly requested remote artifacts may be downloaded by the engine into a local cache.
This plugin adds no analytics, browser identifiers, account collection, or hosted storage. It never executes model code. Static evidence does not establish runtime latency, hardware placement, accuracy, clinical validity, or regulatory compliance. See DEEPBOM privacy and support.
Install a newer release with node /path/to/new/deepbom/install.mjs --workspace /path/to/models, then restart Antigravity. This plugin does not silently update its pinned engine.
agy plugin uninstall deepbomnpm ci --ignore-scripts
npm test
agy plugin validate .
npm run packageThe test suite starts the packaged engine over MCP, checks selected summaries and detailed structure against fixture hashes, verifies a mismatched expected hash is rejected, and verifies that paths outside the workspace are refused. Packaging writes the self-contained plugin to dist/deepbom. See VALIDATION.md for recorded host checks.
Licensed under Apache-2.0. The engine is maintained at JunHwan-Kwon/deepbom.
This server cannot be deployed
Browser-local and CLI static evidence for deployed AI model artifacts.
Generate SBOMs, scan vulnerabilities, and analyze dependencies from local projects or Git repos.
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
Detects database migration table locks, terraform cost leaks, and OWASP API flaws.
