AMM xBOM Sentinel

What the company appears to be: AMM xBOM Sentinel is a self-reported local-first security tool for software supply chain evidence collection and analysis. The author describes it as a repository-focused agent that generates machine-readable output (CycloneDX SBOM, cryptographic diagnostics, drift findings) from supported manifest files and lockfiles.

What changed: This is a solo developer's hackathon project submitted to the OpenAI 2026 hackathon. It represents an initial version 0.1.0 release with limited ecosystem support (Python, Node.js, PHP, Maven, .NET), built using AI-assisted development tools including GPT-5.6 and Codex.

Single most important open question: Does the tool produce actionable security evidence that developers or security teams can meaningfully investigate, or is it primarily a proof-of-concept with limited practical utility?

The description states that AMM xBOM Sentinel:

• Analyzes supported repository evidence and generates:
  • CycloneDX JSON SBOM
  • Dependency and component evidence across supported ecosystems
  • AI- and cryptography-related component classifications
  • Explicit cryptographic algorithm evidence
  • Conservative post-quantum cryptography diagnostic
  • Declared-versus-resolved evidence reconciliation
  • Repository baseline
  • Machine-readable comparison of evidence drift
  • Investigation-oriented findings with stable identifiers

The tool supports:

• Python pyproject.toml
• Node.js package.json and package-lock.json
• PHP composer.json and composer.lock
• Maven pom.xml
• .NET PackageReference entries in .csproj files

It can be used through:

• Python CLI
• Installable Codex plugin
• Codex Skill
• Local MCP server
• Repository-local plugin marketplace
• Composite GitHub Action

The tool is described as local-first, deterministic, and based exclusively on locally available evidence. Source content remains read-only by default.

Evidence strength: Self-reported. No independent verification of functionality or output quality.

The author states that the objective was not to build another dashboard or claim automated compliance, but to create a local-first, repository-focused security tool that produces transparent, machine-readable evidence developers and security teams can investigate.

The product is positioned as:

• A repository evidence agent
• Focused on software supply chain security
• Local-first with deterministic behavior
• Machine-readable output for investigation
• Not claiming compliance or vulnerability scanning

Evidence strength: Self-reported. The description shows a clear intent but no evidence of traction, adoption, or customer feedback.

The author states that the tool is intended for:

• Developers
• Security teams
• Codex (AI agent integration)

It is described as producing evidence that can be investigated by humans and AI agents. The tool targets software supply chain security needs, particularly around cryptography and post-quantum readiness.

Evidence strength: Self-reported. No evidence of actual customers or usage data.

The description does not state:

• Revenue model
• Pricing structure
• Commercial licensing terms
• Subscription or one-time purchase model

It only describes the tool's technical capabilities and delivery methods.

Evidence strength: Not evidenced.

The author states that:

• The architecture was designed as local-first
• Repository analysis is deterministic and based exclusively on locally available evidence
• No OpenAI API calls at runtime
• Implementation was developed in validated stages
• Supports multiple delivery mechanisms (CLI, Codex plugin, GitHub Action)
• Uses a local MCP server for repository analysis
• Includes prebuilt Python wheel with SHA-256 verification
• Apache-2.0 licensing
• Reproducible judge workflow without rebuilding from source

The tool is described as:

• Deterministic and reproducible
• Focused on static evidence
• Designed for both human and AI-assisted workflows
• Uses stable finding identifiers and path contracts

Evidence strength: Self-reported. No independent verification of technical performance or reliability.

The description states that this is:

• A solo developer's hackathon project
• Version 0.1.0 release
• Built in a short timeframe (hackathon)
• Not claimed to be production-ready
• Intentionally constrained scope

No evidence of:

• Revenue
• Customers
• Adoption metrics
• Usage data
• Product-market fit indicators

Evidence strength: Not evidenced.

The description does not mention:

• Competitors
• Market positioning relative to existing tools
• Differentiation from other SBOM or supply chain security tools

It only describes the tool's own capabilities and limitations.

Evidence strength: Not evidenced.

Key risks and red flags based on the description:

1. Solo developer project: No team, no institutional support, limited scalability
2. Hackathon origin: Version 0.1.0 with constrained scope, not production-ready
3. No commercial traction: No evidence of revenue, customers, or adoption
4. AI-assisted development: Reliance on AI tools may indicate lack of deep technical ownership or control
5. Limited ecosystem support: Only five ecosystems supported in v0.1.0
6. Self-reported claims: All descriptions are unverified and self-evidenced
7. No security validation: No evidence of independent security review or testing

Evidence strength: Inferred from description; not independently verified.

1. What is the actual problem you're solving, and how do you know it's real?
2. How does this tool integrate with existing CI/CD pipelines?
3. What are the specific use cases where developers or security teams would actually use this?
4. Have you tested it in real-world repositories beyond the synthetic demo?
5. What is your roadmap for expanding ecosystem support?
6. How do you plan to monetize this tool if at all?
7. What is the long-term vision for AMM xBOM Sentinel?
8. How does it compare to existing SBOM tools like CycloneDX, SPDX, or others?

Evidence strength: Inferences based on self-reported description.