npx -y deepbom@1.106.0 integrate codex
npx -y deepbom@1.106.0 integrate codex --apply
npx -y deepbom@1.106.0 integrate claude-code
npx -y deepbom@1.106.0 integrate claude-code --apply

npx deepbom audit model.onnx --format cyclonedx
npx deepbom audit model.onnx --format sarif --output deepbom.sarif --fail-on high
npx deepbom capabilities --compact
npx deepbom gguf model.gguf --context 8192 --memory-mib 8192
npx deepbom audit Model.mlpackage --compact
npx deepbom audit safetensors-repository/ --compact
npx deepbom verify model.onnx --bom supplied.cdx.json --render markdown
npx deepbom contract capture model.onnx -o baseline.interface-contract.json
npx deepbom verify model.tflite --contract production-interface.json
npx deepbom diff baseline.gguf candidate.gguf --tensors --render markdown
npx deepbom explore model.tflite --target-profile target-profile.json
npx deepbom audit model.pte --executorch-build deepbom.executorch-build.json --compact
npx deepbom capabilities --format agent-json
npx deepbom capabilities --format agent-text
npx -y deepbom@1.106.0 mcp

Claude Desktop can install the version-matched deepbom-1.106.0.mcpb asset from the corresponding GitHub Release as a local desktop extension.

ChatGPT developer-mode users can connect https://deepbom.org/mcp for one authorized attachment. Analysis runs in the ChatGPT browser sandbox; the DEEPBOM service receives only a bounded result and does not fetch or retain model bytes. Public ChatGPT discovery requires separate OpenAI review. Use the local package for confidential or large files, directories, shards, sidecars, complete exports, and repeat automation.

On a Claude host that supports remote MCP Apps, private testers can add the separate https://deepbom.org/mcp/claude connector. It requires an explicit file selection inside the app and does not automatically access Claude attachments. The selected bytes stay in the browser sandbox; only a bounded result is returned to the conversation. Public Claude discovery remains subject to Anthropic review. Use the local package or MCPB when model-derived facts must not leave the computer.

The default output is a bounded human-readable summary. Use --json or --compact for the complete analysis document, --format envelope for the canonical cross-format contract, --format cyclonedx for CycloneDX 1.7, or --format sarif for OASIS SARIF 2.1.0. --policy-output records a deterministic finding gate when --fail-on is selected.

verify --bom reconciles an exactly selected CycloneDX 1.7 component with artifact-observable facts; publisher declarations remain not assessable from the file. contract capture creates an artifact-derived interface baseline, not an approved production contract. verify --contract fails closed on interface contradictions, diff preserves the canonical multi-target TFLite delta ledger, and explore exposes deterministic WASM Pareto candidates. These commands do not add a second analysis engine.

The package contains one generated JavaScript analysis bundle and the canonical TFLite WebAssembly module. It does not send model bytes or results over the network, and it does not depend on a hosted DEEPBOM analysis endpoint. A plain chat client without local shell or MCP access cannot execute an audit. TensorRT parser observations and build profiles can be imported with --tensorrt-parser-evidence and --tensorrt-profile.

ONNX external data next to the model is discovered only from safe serialized references. Use --external-data-dir to bind a different explicit root. ExecuTorch PTE audits use the same option for PTD data; --executorch-build binds a duplicate-key-checked selected-build and binary inventory without promoting it to observed execution. Core ML packages and sharded SafeTensors repositories are hashed as canonical multi-file artifact sets rather than collapsed to one unqualified file hash.

Static provider/delegate placement remains predicted or conditionally eligible unless an identity-bound runtime or parser observation is imported.

For the installed version, deepbom --help and deepbom capabilities --compact are authoritative. The current source inventory is maintained in the generated CLI reference.

This public channel package is licensed under Apache-2.0. Protected analyzers and private rulepack-generation sources are not included.