AI-BOM evidence that survives review.
SIGIL inventories local model artefacts, verifies digests, detects license metadata, and emits synchronized JSON and Markdown that a reviewer can attach to an audit ticket.
AI Security / Local AI-BOM / Offensive Research
Local-first AI-BOMs for auditing local LLMs.
SIGIL turns local AI runtimes, model stores, native binaries, and policy into deterministic evidence. Inspect what is running, where it is exposed, and why a system earns PASS, WARN, or FAIL.
sigil://lab
$ sigil aibom generate --runtime ollama
[ai] reading local model manifests...
[sec] classifying runtime exposure...
[dev] mapping native capability evidence...
[ok] report sealed as schema 1.1.
RESEARCH
LOCAL AI RISK
BUILD
SECURE BY DEFAULT
Platform
Security tooling for the local AI software era.
Runtime exposure without shelling out.
Ollama endpoints and Linux listener state are classified in place: localhost, LAN, public bind, docker-published, reverse proxy, or unavailable.
Verdicts from policy, not vibes.
PASS, WARN, and FAIL come from deterministic analyzers and YAML policy. No cloud call and no LLM sits in the verdict path.
Research DNA
Built with the mindset of an offensive lab.
SIGIL treats a local AI deployment as an attack surface: model provenance, runtime exposure, native capability evidence, and policy all matter together. The result is security software that feels sharp, calm, and usable under pressure.
Tools
From investigation to evidence.
Understand local AI surfaces faster.
Walk Ollama model stores, runtime settings, and observed binds into one security picture.
Tie findings to deterministic verdicts.
Evaluate native binary capabilities and runtime evidence against explicit policy instead of opaque scoring.
Give reviewers the artefact they need.
Generate schema-stable AI-BOM JSON, Markdown reports, and a browser viewer that runs fully client-side.
Live Artefacts
Evidence you can open now.
Viewer
Try the AI-BOM viewer.
Load sample PASS, WARN, and FAIL reports in the browser with no upload path.
CompareSee SIGIL beside adjacent tools.
Compare against Anchore Syft, vendor built-ins, and OWASP AIBOM Generator.
ReportRead State of Local AI Audit.
The 2026 H1 report captures where local AI audit evidence is still missing.
Start
Seal your local AI system with intent.
Run SIGIL locally, inspect the emitted evidence, and wire the report into your review workflow.