Supply-chain security starts with a component list built from reality: endpoint and repository discovery of MCP servers, agent skills, and assistant integrations, matched against the risk-scored catalog. The result is an AI bill of materials generated from live usage — the artifact both your incident responders and your Article-11 documentation quietly assume exists.
Agents consume their supply chain at runtime: tool descriptions, skill files, retrieved documents. Each is screened for embedded instructions and unsafe patterns before it enters context, and the 2026 incident record — poisoned tool metadata, trojanized packages seeded into popular agent frameworks — is exactly the class this interception exists for.
The dangerous moment in any supply chain is the silent update — a server that yesterday declared three read-only tools and today declares a write scope. Capability changes, new maintainers, and altered descriptions surface as events with the full audit trail attached, so review happens before adoption rather than after impact.
Software-composition analysis reads manifests at build time. The AI supply chain is consumed at runtime by agents — tool descriptions, skills, MCP servers — mostly outside any manifest your SCA sees. The disciplines complement; neither substitutes.
The word “AIBOM” isn’t in a statute, but the substance is converging: the EU AI Act’s technical documentation, DORA’s ICT register, and vendor questionnaires all ask for component enumeration. Building it from live discovery beats reconstructing it under deadline.
That is the design: descriptions and skills are screened on ingestion, unknowns are quarantined, and destructive capabilities require approval — so a poisoned component meets policy before it meets your agent.
Model provenance lands in the inventory (which models, from which providers, in which tools), and subprocessor changes — like a productivity suite quietly adding a new model provider — surface as supply-chain events for review.