This article introduces a novel AI‑driven engine that evaluates open‑source compliance risk instantly. By ingesting Software Bill of Materials, enriching them with a dynamic knowledge graph, and applying graph neural networks together with large language models, the system delivers continuous, explainable risk scores that integrate directly into CI/CD pipelines while preserving privacy through zero‑knowledge proofs.