Manage your AI attack surface

AI Attack Surface Management builds an evidence-backed inventory of the AI providers, models, frameworks, prompts, agents, tools, Model Context Protocol (MCP) servers, vector databases, guardrails, and application endpoints declared in your repositories. Open AI Attack Surface from the dashboard sidebar.

Establish an inventory

1. Connect a repository and run a Smart or Deep scan.
2. Open AI Attack Surface → Overview.
3. Check the repository freshness and latest-run coverage before relying on the inventory.
4. Open Inventory to review each discovered asset and its source evidence.

The inventory recognizes common AI providers and platforms, including OpenAI, Anthropic, Google Gemini and Vertex AI, Azure OpenAI, Amazon Bedrock, Cohere, Mistral AI, Hugging Face, Replicate, Groq, Together AI, and Ollama. It also recognizes common orchestration frameworks, vector stores, guardrails, MCP configuration, model identifiers, prompts, agents, tools, and AI-facing routes.

Understand coverage and freshness

The Runs view records the branch, commit, engine version, files considered, files scanned, skipped files, discovered assets, findings, policy result, and coverage state.

Repository freshness is updated only by a complete default-branch reconciliation. Feature-branch scans add evidence but do not silently remove assets from the current default-branch inventory.

Build an AI Bill of Materials

Select one repository, then open AI Attack Surface → AI BOM. CodeStax builds the BOM from the repository’s latest complete, authoritative default-branch generation. Preview, partial, failed, and non-applicable runs cannot become BOM generations.

The BOM workspace shows:

• the generation, exact commit, scan completion time, and snapshot fidelity;
• model, data-asset, provider, and relationship counts;
• explicit identity, version, supplier, license, source-provenance, and governance coverage;
• independent readiness for CycloneDX and SPDX; and
• changes between authoritative generations.

Export CycloneDX 1.7

CycloneDX AI/ML-BOM is available when the selected repository has a complete authoritative generation. Models are exported as machine-learning-model, prompts and data assets as data, frameworks with their standard type, and endpoints as services only when evidence contains a real absolute URI. CodeStax does not invent endpoint schemes, unknown versions, or empty dependency declarations.

Exports use stable identifiers, the scan completion time, the repository commit, and canonical JSON ordering. Repeating an export without changing its inputs produces the same bytes and SHA-256 digest.

Prepare SPDX 3.0.1 AI Profile

SPDX AI Profile has mandatory facts that static source detection cannot safely infer. For every model, an organization admin must declare and verify its supplier, release time, download location, and package version. Dataset assets additionally require a built time and dataset type. A license may be explicitly declared or left as SPDX NoAssertion.

Use Complete declaration beside a blocked asset. Record the upstream or repository source, optionally add its SHA-256 digest, and mark the declaration verified only after checking that source. Updates use optimistic versions and are written to the organization audit log.

CodeStax blocks the SPDX download until every relevant asset is ready. It never substitutes the scan time for a model release time, a repository URL for a model download location, or a detected provider name for a verified supplier.

Compare generations

The generation comparison classifies added, removed, modified, evidence-only, and relationship changes from immutable per-run asset snapshots. If a legacy generation cannot reconstruct every discovered asset, the export fails explicitly. If the canonicalization version changes, CodeStax requires a rebaseline instead of presenting widespread identity churn as real additions and removals.

Historical asset fields come from the immutable selected generation. Human declarations use the latest verified revision at export time and are labeled current-at-export; changing a declaration changes the BOM artifact ID, version, timestamp, and digest without rewriting the scan snapshot.

Review the topology

Open Topology to see relationships inferred from colocated evidence. Relationships can show that an endpoint, framework, or agent:

• uses a model or provider;
• retrieves from a vector database or knowledge source;
• invokes a tool or MCP server; or
• is protected by a guardrail.

Topology is static evidence, not a runtime trace. Confirm consequential paths in the source before changing production controls.

Triage AI-specific findings

The Findings view maps risks to the OWASP Top 10 for LLM Applications 2025 categories. Shipped checks cover prompt injection, sensitive-data exposure, AI supply-chain pinning, data and model poisoning, unsafe model-output handling, excessive agency, system-prompt exposure, vector and embedding isolation, unvalidated model decisions, and unbounded consumption.

Each finding includes a stable rule ID, severity, confidence state, source location, redacted evidence summary, and remediation guidance. Members can move a finding through these states:

• open
• acknowledged
• accepted_risk
• resolved
• dismissed

A reason is required for accepted-risk, resolved, and dismissed states. Triage changes are written to the organization audit log.

Approve assets

Organization admins and owners can set an asset to Approved, Restricted, Denied, or Unreviewed. Every approval change requires a reason and is audit logged.

Use approval to record governance decisions, not to hide discovery evidence. A denied asset remains visible until a later complete default-branch scan proves it is no longer present.

Configure policy

Open AI Attack Surface → Policy to configure the organization policy and optional repository overrides. Available controls include:

• provider allowlisting and denied model identifiers;
• model-version pinning;
• approved-asset requirements;
• prompt-injection and sensitive-data-exposure blocking;
• failure on incomplete coverage;
• maximum critical and high findings; and
• an optional policy gate.

Policy updates use version checks so a stale admin session cannot overwrite a newer change. Repository overrides inherit unspecified fields from the organization policy and can be deleted to return to full inheritance.

Use expiring waivers

Organization admins and owners can create an expiring waiver for an organization, repository, or individual finding. A waiver must name a rule, include a reason, and expire within 366 days. Revoking a waiver is also audit logged.

Export evidence

Use Export inventory or Export findings in the dashboard, or call GET /api/ai-asm/export. CSV exports are tenant scoped, protect spreadsheet cells from formula injection, and are capped at 10,000 rows. The response header X-Export-Truncated reports whether more rows existed.

See the AI Attack Surface API for automation examples.