Pitloom

Pitloom automates the generation of SPDX 3-compliant SBOMs for AI models and Python projects, documenting the composition and provenance of software systems. It reads metadata directly from Python packages and AI models (GGUF, ONNX, PyTorch, Safetensors) and offers native Hatchling integration so SBOMs can be generated automatically as part of a build.

When used with Hatchling, it embeds the generated SBOM directly into the Python distribution package (wheel) .dist-info/sboms -- follows PEP 770.

Install

pip install pitloom

Install with AI model metadata extraction support:

pip install "pitloom[ai]"

Install with extra content type detection:

pip install "pitloom[content-type]"

Pick your usage surface

Pitloom generates the same kind of SBOM regardless of how you invoke it (so long as it's the same target) -- pick the page for how you actually want to run it. Each page has its own quick guide, install steps, usage details, config, and code examples.

Surface	Reach for this when...
Command line (loom)	You want a one-off SBOM from a terminal, a Makefile target, or any shell script.
Python API	You are calling Pitloom from Python code you control, or want to track provenance during training/evaluation.
Hatchling build hook	You build wheels with Hatchling and want an SBOM embedded automatically (PEP 770).
GitHub Action	Your project isn't Hatchling-based, or you just want CI to produce an SBOM artifact with one uses: line.
Agent Skills	You want an AI coding agent to generate (and optionally enrich or validate) an SBOM on request.
Claude Code plugin	You use Claude Code and want the Skills installable with one command.

Reference docs

Background reading -- useful for auditing or debugging a generated SBOM, not needed to just generate one:

• Configuration -- every [tool.pitloom] setting, its default, and how to reach it from each surface.
• Creation metadata -- who/what/when/how every Pitloom-generated element records about its own creation.
• Metadata provenance -- how Pitloom tracks the source of each metadata field for auditability.
• Resources -- SBOM, AIBOM, SPDX, and related standards reading list.
• Project README for more information.

Security

For supported versions and vulnerability reporting guidelines, please read our Security policy.

Citation

If you use Pitloom in your academic work, please cite it as follows:

Suriyawongkul, A. (2026). Pitloom - SBOM generator for AI models and Python projects (Version 0.16.4) [Computer software]. https://doi.org/10.5281/zenodo.19246283

BibTeX:

@software{Suriyawongkul_Pitloom_-_SBOM_2026,
    author = {Suriyawongkul, Arthit},
    doi = {10.5281/zenodo.19246283},
    month = aug,
    title = {{Pitloom - SBOM generator for AI models and Python projects}},
    url = {https://github.com/bact/pitloom},
    version = {0.16.4},
    year = {2026}
}