Back to guides

Guide · Cybersecurity

AI Supply Chain: SBOM, Models, and MCP Verification

Your AI stack is a supply chain—models, SDKs, prompt packs, and MCP servers. If you cannot name and verify what you run, you fail APRF Supply Chain.

Unverified models and MCP hosts fail Supply Chain—inventory, pin, and attest what you run. Primary control: Supply Chain

If you cannot name it, you cannot trust it

AI supply chain covers every dependency that changes behavior or reach: model IDs and fine-tunes, inference SDKs, vector clients, MCP servers, prompt/context digests. An SBOM (or AI bill of materials) plus pins is how you prove what shipped—APRF Supply Chain, adjacent to Model Governance and Tool Safety.

Production once pointed at a public MCP "browser" server and a floating model alias. An upstream change later posted customer data to an unexpected domain. No server digest, no model pin, no BOM entry. Recovery meant reconstructing trust from chat logs.

Inventory → pin → attest

1. List models (provider + immutable ID), MCP hosts, critical SDKs, artifact digests

2. Pin IDs and digests in config—block `latest` and unknown MCP hosts

3. Verify signatures/checksums where you can; reject the rest

4. Emit BOM at release next to the deploy artifact

5. Log `model_id`, `mcp_server_version`, digests at runtime

Tool Safety decides which tools may run. Supply Chain decides which hosts and models are allowed to exist in the environment at all.

Change control

New MCP server or model ID is a reviewed change (Change Management)—not a Friday dashboard click. Hosted APIs still count: pin the provider revision, treat SDK bumps as supply-chain events, keep a revoke path when a server is compromised.

Assess against APRF Core

Run the Core Profile quiz — gated pass/fail blockers for AI production readiness, not a vanity score.

Start Core AssessmentBrowse framework

Related

Frequently asked questions

Is a traditional SBOM enough?
It is a start. Extend it (or maintain a companion AI BOM) for model IDs, prompt/context digests, and MCP servers—those change behavior without a normal package bump.
How does this differ from Tool Safety?
Tool Safety decides which tools may run and how args are validated. Supply Chain decides which tool hosts and models you trust to exist at all.
Do hosted model APIs need this?
Yes. Pin the provider model ID, record it in releases, and treat SDK upgrades as supply-chain changes.