TReqs/hf-aibom-scorer

How complete is my model's AI-BOM?

A Gradio app that scores how complete an AI-BOM can get for a public Hugging Face model, using only Hugging Face's public metadata — no login, no upload, no model weights downloaded or run.

Paste a model id, see:

• —A completeness score using GLaaS's own scoring method (category breakdown: required fields, metadata, component basics, lineage & provenance, external references).
• —The same synthesized BOM scored by two other public tools' methods, shown as a reference, not a replacement for the breakdown above:
• —OWASP AIBOM Generator
• —CycloneDX BOM Studio
• —Why specific fields are missing — in particular, Lineage & Provenance fields (formulation, dependencies, per-task inputs/outputs) can never be filled from model-card metadata alone, since they require an observed training pipeline, not a description of one. That's the gap GLaaS + roar close automatically.

A second tab logs every model scored locally, for testing across many models at once — a dev tool, not necessarily part of the eventual public Space.

Status

Phase 1: local development. Everything (HF fetch → partial BOM → scoring → UI) runs in this single Gradio app. Phases 2–3 split the fetch/ scoring pieces out into a glaas-api endpoint and deploy the UI as a Hugging Face Space — see design-docs/20260709 HF-ai-bom-space.md in the parent repo for that plan.

Running locally

From this directory (hyperbox/treqs-hf-aibom/):

python3 -m venv .venv
source .venv/bin/activate        # Windows: .venv\Scripts\activate
pip install -r requirements.txt
python app.py

Gradio prints a local URL (default http://127.0.0.1:7860) — open it in a browser. Try a model id like openai-community/gpt2 or microsoft/Phi-4 in the Score a model tab, then check the Scored models tab to see it recorded (backed by a local SQLite file at data/scored_models.db, gitignored).

No API keys or secrets are required — every request goes to Hugging Face's public, unauthenticated metadata API.

Project layout

app.py                      Gradio entrypoint (two tabs)
src/
  hf_client.py               Fetches public HF model metadata + README snippet
  bom_builder.py              Builds a partial CycloneDX BOM from that metadata
  storage.py                  SQLite log of scored models
  scoring/
    glaas_scorer.py            Our scoring method (ported from glaas-api)
    owasp_scorer.py             OWASP AIBOM Generator's method (reference)
    owasp_field_registry.json    Vendored unmodified from that project (Apache-2.0)
    cyclonedx_studio_scorer.py  CycloneDX BOM Studio's method (reference)
  ui/
    score_tab.py                "Score a model" tab
    log_tab.py                   "Scored models" tab