• AUDIT
  • MAP
  • FIX
  • REVIEW

How to inspect your software bill of materials with your AI

Connect FOSSA to your AI client to pull deep dependency data for any specific code revision. Once connected, your agent handles the heavy lifting of mapping out your software supply chain.

Ask AI about this page

Short answer

How do I inspect my SBOM with AI?

Your AI uses the FOSSA connector to fetch the exact dependency tree for a specific revision. This gives you a clear view of every package and license in your build. You'll get a full breakdown of the dependency hierarchy and license risks.

The outcomes.

Where your dependency data lands.

The AI processes the raw dependency data into actionable insights.

AUDIT

License risk reports

The AI identifies conflicting or restrictive licenses within the dependency tree. You get a list of specific packages that need attention.

MAP

Dependency hierarchies

Your agent maps out how packages relate to one another. You can see exactly which top-level dependency pulled in a problematic sub-package.

FIX

Remediation paths

The AI suggests safer versions of packages to resolve license or security issues. You get specific version numbers to target in your next update.

REVIEW

Human verification

The AI flags the most critical license violations for you to review. You decide if a package meets your legal requirements or needs to be swapped.

The workflow

What your AI does when the revision is identified.

The AI moves from raw data retrieval to actionable dependency analysis.

  1. Fetch the tree

    The AI reaches into FOSSA to pull the complete list of dependencies for your chosen revision.

    get_revision_dependencies

  2. Analyze licenses

    The agent scans the retrieved package list to find any legal or compliance issues.

    get_revision_dependencies

  3. Trace origins

    Your AI follows the path from your direct dependencies down to the deepest transitive packages.

    get_revision_dependencies

  4. Summarize risks

    The agent condenses the massive dependency list into a readable report of high-priority issues.

    get_revision_dependencies

Try it

Copy these to start.

Use these prompts to begin your audit.

Starting points

Swap the bracketed text for your actual repository names or revision IDs.

FOSSA Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_OrrKjBZcQcoQ9lOxWynXvkokseUtlrQY2s1yYaDD/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — FOSSA capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "fossa-license-compliance-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_OrrKjBZcQcoQ9lOxWynXvkokseUtlrQY2s1yYaDD/mcp"
    }
  }
}
Copy into chat04

  • Get the dependency tree for the 'main' branch in my 'web-app' repo.

  • List all packages in the current revision that use a GPL license.

  • Show me the dependency path for the 'log4j' package in this project.

  • Which transitive dependencies in my 'api-service' repo have restrictive licenses?

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect FOSSA once, then ask.

Just link your FOSSA account through the Vinkius dashboard. Your credentials stay encrypted, and you can immediately start asking your AI about your code's dependencies.

Connect FOSSA to your AI

FAQ

How this task behaves

  • 01

    Can the AI change my code to fix license issues?

    No. The AI only reads the dependency data and suggests fixes. You must manually update your manifest files to apply any changes.

  • 02

    Does the AI scan my source code directly?

    No. The AI uses the data provided by FOSSA to analyze the dependency tree and licenses already identified in your project.

  • 03

    Can I audit a specific Git commit?

    Yes. You can ask the AI to pull the dependency information for any specific revision or commit hash available in FOSSA.

  • 04

    Will the AI delete any packages from my project?

    No. The AI has no write access to your repositories or your FOSSA configuration. It only provides analysis and suggestions.

  • 05

    How does the AI know which licenses are risky?

    The AI processes the license metadata returned by the FOSSA tool to identify packages that conflict with your specified policies.

  • More questions about FOSSA? See everything the FOSSA Connector can do

Connect FOSSA to Claude, Cursor, ChatGPT & more