Runtime AIBOM
An AIBOM built from what is running and being used, not only from what is installed or declared: which model servers are listening, which MCP servers agents actually call, which keys are in use. It changes as the device does, so it is regenerated continuously rather than written once at build time.
How MoorAI handles it: moorai-aibom reports which local model servers and local MCP servers are running, not only installed, and counts guarded agent calls per tool.
See also AIBOM · permission right-sizing · shadow AI
Related terms
-
AIBOM
Defence & response
An inventory of the AI components in a system or on a device — models and their providers, agents and harnesses, MCP servers, plugins, skills, datasets …
-
Permission right-sizing
Defence & response
Cutting the permissions an agent is granted down to the ones it uses: comparing what a configuration allows — tools, commands, directories, MCP servers…
-
Shadow AI
Attack concepts
AI tools, agents, models and MCP servers in use without the security team's knowledge or approval: a developer's own coding agent, a chatbot fed…
Defence & response
The vocabulary of running controls for agents: knowing what AI is present, cutting what it may do down to what it uses, catching misuse, and reconstructing an incident afterwards. Where MoorAI implements a term, a separate line under the definition says how; the definition itself stays vendor-neutral. To check one agent's configuration against these ideas, use the free permission right-sizer.