Every primary component and service in use is described in the SBOM, together with, as far as practicable, the secondary transitive relationships and dependencies behind them.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.