{"id":18033588,"url":"https://github.com/sozercan/guac-ai-mole","last_synced_at":"2025-09-28T20:31:07.198Z","repository":{"id":194843950,"uuid":"690233023","full_name":"sozercan/guac-ai-mole","owner":"sozercan","description":"🥑 Inspect and understand an organization's software supply chain that enables stakeholders to make actionable decisions about software supply chain security","archived":false,"fork":false,"pushed_at":"2024-04-15T21:59:58.000Z","size":63,"stargazers_count":18,"open_issues_count":3,"forks_count":8,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-01-03T12:43:24.834Z","etag":null,"topics":["ai","chatgpt","gpt-4","guac","openai","sbom","secure-supply-chain","security","security-tools","streamlit","supply-chain-security"],"latest_commit_sha":null,"homepage":"https://guac-ai-mole.streamlit.app","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sozercan.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2023-09-11T19:47:18.000Z","updated_at":"2024-12-31T13:18:27.000Z","dependencies_parsed_at":"2023-09-15T11:14:27.934Z","dependency_job_id":"f7226f8a-7434-414b-bee7-950c913827f5","html_url":"https://github.com/sozercan/guac-ai-mole","commit_stats":null,"previous_names":["sozercan/guac-ai-mole"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sozercan%2Fguac-ai-mole","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sozercan%2Fguac-ai-mole/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sozercan%2Fguac-ai-mole/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sozercan%2Fguac-ai-mole/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sozercan","download_url":"https://codeload.github.com/sozercan/guac-ai-mole/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":234440841,"owners_count":18833073,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ai","chatgpt","gpt-4","guac","openai","sbom","secure-supply-chain","security","security-tools","streamlit","supply-chain-security"],"created_at":"2024-10-30T11:07:49.019Z","updated_at":"2025-09-28T20:31:01.940Z","avatar_url":"https://github.com/sozercan.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# 🥑 Guac-AI-Mole\n\nGuac-AI-Mole is a [large language model (LLM)](https://en.wikipedia.org/wiki/Large_language_model) powered tool to inspect and understand an organization's software supply chain. It uses LLM models, such as OpenAI GPT-4, and [GUAC](https://docs.guac.sh/) to query and analyze the secure supply chain artifacts, such as [Software Bill of Materials (SBOM)](https://www.cisa.gov/sbom), to make actionable decisions.\n\n\u003e 🧪 This is a hackathon project. Do not use in production.\n\n## Demo\n\n[Demo](https://guac-ai-mole.streamlit.app/) will provide samples questions and answers generated by Guac-AI-Mole!\n\n\u003e These answers are pre-generated and cached for faster response times and to avoid needing API access. You can try out your own questions and answers by [setting up the app locally](#development-setup).\n\n### Video\n\n[![Video](https://img.youtube.com/vi/VYn6jJSNpxU/0.jpg)](https://www.youtube.com/watch?v=VYn6jJSNpxU)\n\n## Development Setup\n\n### Pre-requisites\n\n- Install and run [GUAC](https://docs.guac.sh/setup/) using the main branch. It is working as of this [commit](https://github.com/guacsec/guac/commit/3dba718a5c66d0878af8bc90c2a82022a29bfc0f).\n- Install [Steamlit](https://docs.streamlit.io/library/get-started/installation)\n- [OpenAI](https://platform.openai.com/), [Azure OpenAI](https://azure.microsoft.com/en-us/products/ai-services/openai-service), or [LocalAI](https://localai.io/) API access (tested and recommended to use with `gpt-4-32k-0613` and later models)\n\n### Populate registry with sample images and attached SBOMs as OCI referrers artifacts\n\n- Download and copy [ORAS](https://oras.land/docs/installation) and [Syft](https://github.com/anchore/syft) to your `$PATH`\n- Login to your registry (make sure to have push access) and run `export REGISTRY=\u003cregistry name i.e., myregistry.io\u003e` to set your registry\n- Run `scripts/populate-registry.sh` to populate the registry with sample images and attached SBOMs as OCI referrers artifacts\n- You can verify the attached SBOMS by using `oras discover`. For example,\n```shell\n$ oras discover ${REGISTRY}/vul-image:latest\nDiscovered 1 artifact referencing latest\nDigest: sha256:b6f1a6e034d40c240f1d8b0a3f5481aa0a315009f5ac72f736502939419c1855\n\nArtifact Type           Digest\napplication/spdx+json   sha256:5479d40d5d27025ab4eda699e91961fc0537def2ffe850e2c19172b41eb72ca7\n```\n\n### Ingesting SBOMs from OCI referrers to GUAC\n\n- Run `guacone collect registry ${REGISTRY}` to ingest the SBOMs from OCI referrers to GUAC. This will automatically ingest the SBOMs from the OCI referrers to GUAC.\n\n### Run the app\n\n- Install python dependencies with `pip install -r requirements.txt`\n- Run `streamlit run app.py` to start the Streamlit app (add `--logger.level=debug` for debug logs)\n- Navigate to app URL (default: http://localhost:8501)\n- Set up Open AI API-compatible ([OpenAI](https://platform.openai.com/), [Azure OpenAI](https://azure.microsoft.com/en-us/products/ai-services/openai-service), [LocalAI](https://localai.io/)) API Key, endpoint and deployment name in the sidebar on the left\n  - Alternatively, set `OPENAI_API_KEY`, `OPENAI_API_ENDPOINT` and `OPENAI_API_MODEL` environment variables\n- Set up GUAC GraphQL endpoint in the sidebar on the left (default: http://localhost:8080/query). This URL must be accessible from the app.\n  - Alternatively, set `GUAC_GRAPHQL_ENDPOINT` environment variable\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsozercan%2Fguac-ai-mole","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsozercan%2Fguac-ai-mole","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsozercan%2Fguac-ai-mole/lists"}