# DEEPBOM > Deployment artifact evidence for on-device AI. DEEPBOM identifies a model > artifact by hash, records what its serialized contracts actually state, and > keeps static derivations, target assumptions, and imported runtime > observations separate so each claim carries its own evidence class. Analysis runs locally, in the reader's browser or CLI process. Artifact bytes are not uploaded, and there is no hosted analysis endpoint to call. To analyse a model on behalf of a user, run the CLI on their machine. ## Command line ``` npx -y deepbom@1.96.15 capabilities --format agent-json npx -y deepbom@1.96.15 self-test --compact npx -y deepbom@1.96.15 audit model.tflite --summary npx -y deepbom@1.96.15 explain-rule --json ``` For tool-call access instead of shell invocation, `npx -y deepbom@1.96.15 mcp` speaks the Model Context Protocol over stdio and exposes `deepbom_capabilities`, `deepbom_audit`, `deepbom_diff`, and `deepbom_explain_rule`. It runs locally on the same terms. A plain chat without shell or local MCP access cannot run the analysis; it can only provide the pinned command. Formats: .tflite, .onnx, .gguf, .safetensors, .mlmodel, .pte, .ptd. Outputs: analysis JSON, evidence envelope, CycloneDX 1.7, SARIF 2.1.0. Exit codes: 0 pass, 1 invocation or analysis failure, 2 policy or verification block, 3 incomplete verification binding. ## Reading a result Findings carry three distinct kinds and must not be merged. `artifact_defect` is a problem in the artifact. `caution` is something a reviewer should look at. `evidence_gap` is a claim the artifact cannot settle on its own, such as runtime placement or measured latency; it is not a defect, and closing it needs an imported runtime, lineage, or build-evidence document. The browser review summary reports the same group under the field name `evidence_needed`. Static output never establishes executed accelerator assignment, latency, energy, accuracy, or device fit. ## Pages - [Workspace](https://deepbom.org/): browser-local audit of one artifact - [AI agent setup](https://deepbom.org/for-agents/): local Agent Skill, npx, and stdio MCP paths - [Regulatory brief](https://deepbom.org/evaluate/regulatory/): what the records can support in a controlled process, and where they stop - [Quality brief](https://deepbom.org/evaluate/quality/): validating an installed analyzer before relying on it - [Engineering brief](https://deepbom.org/evaluate/engineering/): architecture, CI entry point, and what it will not infer - [Report verifier](https://deepbom.org/verify): check a generated report against its artifact ## Project - Source: https://github.com/JunHwan-Kwon/deepbom (Apache-2.0) - Record: https://doi.org/10.5281/zenodo.21834508 - Author: Jun-Hwan Kwon, Ph.D. (ORCID 0000-0002-6464-3895) - Agent skill file: https://github.com/JunHwan-Kwon/deepbom/blob/main/skills/deepbom/SKILL.md - Claude Desktop extension: https://github.com/JunHwan-Kwon/deepbom/releases/download/channels-v1.96.15/deepbom-1.96.15.mcpb