Extending SPDX
September 10, 2026 · View on GitHub
SPDX 3.0 is one of the three normative AgBOM serializations in v0.1.0. The canonical AgBOM document is the source of truth; SPDX output is derived deterministically from it. The mapping rules live in inspect/format-mapping.json.
Component-type mapping
Each canonical component becomes one SPDX software_Package or Service node. Relationships (DEPENDS_ON, DESCRIBES, USES) reflect the agent_capability/tool/mcp_server graph.
| Canonical type | SPDX class | Notes |
|---|---|---|
model | ai_AIPackage | SPDX 3.0 AI profile node for model artifacts. |
mcp_server | Service | Endpoint reachable via MCP. |
a2a_peer | Service | Cross-agent endpoint; agent_card_ref flows into externalRef. |
tool | software_Package | Agent-callable code unit. |
knowledge_source | Service | Datastore or search endpoint. |
memory_store | Service | Long-lived state store. |
agent_capability | software_Package | Composed capability; its tool/MCP/A2A dependencies become DEPENDS_ON relationships. |
Relationships
| ACS edge | SPDX relationship |
|---|---|
agent_capability.tools[] | agent_capability USES tool |
agent_capability.mcp_servers[] | agent_capability USES mcp_server |
agent_capability.a2a_peers[] | agent_capability USES a2a_peer |
mcp_server.tools[] | mcp_server CONTAINS tool |
| Root agent → all components | agent DEPENDS_ON <component> |
Status
Working draft. The full SPDX 3.0 JSON-LD profile bindings are evolving alongside SPDX's AI profile work.