name: agent-bom description: >- Open security scanner for agentic infrastructure — agents, MCP, packages, blast radius, runtime, and trust across MCP discovery, CVEs, SBOMs, CIS benchmarks (AWS, Azure, GCP, Snowflake), OWASP/NIST/MITRE compliance, AISVS v1.0, MAESTRO layer tagging, and vector database security checks. Use when the user mentions vulnerability scanning, MCP server trust, compliance, SBOM generation, CIS benchmarks, blast radius, or AI supply chain risk. version: 0.103.1 license: Apache-2.0 compatibility: >- Requires Python 3.11+. Install via pipx or pip. No credentials required for basic scanning. Native container image scanning — no external scanner required. CIS benchmark checks optionally use cloud SDK credentials (AWS/Azure/GCP/Snowflake). metadata: author: msaad00 homepage: https://github.com/msaad00/agent-bom source: https://github.com/msaad00/agent-bom pypi: https://pypi.org/project/agent-bom/ scorecard: https://securityscorecards.dev/viewer/?uri=github.com/msaad00/agent-bom tests: 7239 install: pipx: agent-bom pip: agent-bom docker: ghcr.io/msaad00/agent-bom:0.103.1 openclaw: requires: bins: [] env: [] credentials: none credential_policy: >- Zero credentials required for CVE scanning, blast radius, compliance evaluation, SBOM generation, and MCP registry lookups. Optional env vars below increase rate limits or enable cloud CIS checks. Credential-like and sensitive env values in discovered config are replaced with *REDACTED* before reporting; benign configuration values may remain in memory. Verify the sanitize_env_vars() implementation at https://github.com/msaad00/agent-bom/blob/main/src/agent_bom/security.py optional_env:

• name: SNYK_TOKEN

purpose: "Optional third-party vulnerability enrichment for code_scan (requires SNYK_TOKEN)" required: false

• name: AWS_PROFILE

purpose: "AWS CIS benchmark checks — uses boto3 with local AWS profile" required: false

• name: AZURE_TENANT_ID

purpose: "Azure CIS benchmark checks (azure-mgmt-* SDK)" required: false

• name: AZURE_CLIENT_ID

purpose: "Azure CIS benchmark checks — service principal client ID" required: false

• name: AZURE_CLIENT_SECRET

purpose: "Azure CIS benchmark checks — service principal secret" required: false

• name: GOOGLE_APPLICATION_CREDENTIALS

purpose: "GCP CIS benchmark checks (google-cloud-* SDK)" required: false

• name: SNOWFLAKE_ACCOUNT

purpose: "Snowflake CIS benchmark checks" required: false

• name: SNOWFLAKE_USER

purpose: "Snowflake CIS benchmark checks" required: false

• name: SNOWFLAKE_PRIVATE_KEY_PATH

purpose: "Snowflake key-pair auth (CI/CD)" required: false

• name: SNOWFLAKE_AUTHENTICATOR

purpose: "Snowflake auth method (default: externalbrowser SSO)" required: false optional_bins:

• semgrep
• kubectl

emoji: "\U0001F6E1" homepage: https://github.com/msaad00/agent-bom source: https://github.com/msaad00/agent-bom license: Apache-2.0 os:

• darwin
• linux
• windows

install_verification: >- VERIFY BEFORE running with any config files: (1) pip install agent-bom; (2) Review sanitize_env_vars() in security.py — confirms sensitive-value redaction; (3) Review discovery/__init__.py — confirms structural config data extracted; (4) agent-bom verify agent-bom — Sigstore provenance check; (5) Only then run agent-bom scan credential_handling: >- sanitize_env_vars() replaces credential-like and sensitive environment values with *REDACTED* before reporting. Benign configuration values may remain in the in-memory model. Source: https://github.com/msaad00/agent-bom/blob/main/src/agent_bom/security.py data_flow: >- Scanning is local-first. What leaves the machine: (1) public package names and CVE IDs sent to vulnerability databases (OSV, NVD, EPSS, GitHub Advisories) for CVE lookup; (2) CIS benchmark checks make read-only API calls to cloud providers (AWS/Azure/GCP/Snowflake) using your locally configured credentials, only when explicitly invoked. What stays local: all config file contents, env var values, credentials, scan results, compliance tags, and SBOM data. Registry lookups (1123 MCP servers) are bundled in-package with zero network calls. Credential-like and sensitive values in discovered config are redacted by sanitize_env_vars(); benign configuration values may remain in memory. file_reads: # Claude Desktop

• "~/Library/Application Support/Claude/claude_desktop_config.json"
• "~/.config/Claude/claude_desktop_config.json"

# Claude Code

• "~/.claude/settings.json"
• "~/.claude.json"

# Cursor

• "~/.cursor/mcp.json"
• "~/Library/Application Support/Cursor/User/globalStorage/cursor.mcp/mcp.json"

# Windsurf

• "~/.windsurf/mcp.json"

# Cline

• "~/Library/Application Support/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json"

# VS Code Copilot

• "~/Library/Application Support/Code/User/mcp.json"

# Codex CLI

• "~/.codex/config.toml"

# Gemini CLI

• "~/.gemini/settings.json"

# Goose

• "~/.config/goose/config.yaml"

# Continue

• "~/.continue/config.json"

# Zed

• "~/.config/zed/settings.json"

# Roo Code

• "~/Library/Application Support/Code/User/globalStorage/rooveterinaryinc.roo-cline/settings/cline_mcp_settings.json"

# Amazon Q

• "~/Library/Application Support/Code/User/globalStorage/amazonwebservices.amazon-q-vscode/mcp.json"

# JetBrains AI

• "~/Library/Application Support/JetBrains/*/mcp.json"
• "~/.config/github-copilot/intellij/mcp.json"

# Junie

• "~/.junie/mcp/mcp.json"

# GitHub Copilot CLI

• "~/.copilot/mcp-config.json"

# Tabnine

• "~/.tabnine/mcp_servers.json"

# Cortex Code (Snowflake)

• "~/.snowflake/cortex/mcp.json"
• "~/.snowflake/cortex/settings.json"
• "~/.snowflake/cortex/permissions.json"
• "~/.snowflake/cortex/hooks.json"

# Snowflake CLI

• "~/.snowflake/connections.toml"
• "~/.snowflake/config.toml"

# Project-level configs

• ".mcp.json"
• ".vscode/mcp.json"
• ".cursor/mcp.json"

# User-provided files

• "user-provided SBOM files (CycloneDX/SPDX JSON)"
• "user-provided policy files (YAML/JSON policy-as-code)"
• "user-provided audit log files (JSONL from agent-bom proxy)"
• "user-provided SKILL.md files (for skill_trust analysis)"

file_writes: [] network_endpoints:

• url: "https://api.osv.dev/v1"

purpose: "OSV vulnerability database — batch CVE lookup for packages" auth: false

• url: "https://services.nvd.nist.gov/rest/json/cves/2.0"

purpose: "NVD secondary enrichment — adds CWE IDs, dates, references (no key required)" auth: false

• url: "https://api.first.org/data/v1/epss"

purpose: "EPSS exploit probability scores" auth: false

• url: "https://api.github.com/advisories"

purpose: "GitHub Security Advisories — supplemental CVE lookup" auth: false

• url: "https://api.snyk.io"

purpose: "Optional third-party vulnerability enrichment for code_scan (requires SNYK_TOKEN)" auth: true

• url: "https://*.amazonaws.com"

purpose: "AWS CIS benchmark checks — read-only API calls (optional, user-initiated)" auth: true optional: true

• url: "https://management.azure.com"

purpose: "Azure CIS benchmark checks — read-only API calls (optional, user-initiated)" auth: true optional: true

• url: "https://*.googleapis.com"

purpose: "GCP CIS benchmark checks — read-only API calls (optional, user-initiated)" auth: true optional: true

• url: "https://*.snowflakecomputing.com"

purpose: "Snowflake CIS benchmark checks — read-only API calls (optional, user-initiated)" auth: true optional: true telemetry: false persistence: false privilege_escalation: false always: false autonomous_invocation: restricted

agent-bom — AI Agent Infrastructure Security Scanner

Discovers MCP clients and servers across 29 first-class client types, scans for CVEs, maps blast radius, runs cloud CIS benchmarks, checks OWASP/NIST/MITRE compliance, generates SBOMs, and assesses AI infrastructure against AISVS v1.0 and MAESTRO framework layers.

Install

pipx install agent-bom
agent-bom scan            # auto-discover + scan
agent-bom check langchain==0.1.0  # check a specific package with version
agent-bom fs .              # scan filesystem packages
agent-bom image nginx:1.25  # scan container image (native)
agent-bom cloud aws         # AWS CIS benchmark
agent-bom iac infra/        # scan Terraform/CloudFormation
agent-bom where             # show all discovery paths

As an MCP Server

{
  "mcpServers": {
    "agent-bom": {
      "command": "uvx",
      "args": ["agent-bom", "mcp", "server"]
    }
  }
}

Sub-Skills (15)

Tools

Vulnerability Scanning

Compliance & Policy

Registry & Trust

Runtime & Analytics

Specialized Scans

Resources

Example Workflows

# Check a package before installing
check(package="@modelcontextprotocol/server-filesystem", ecosystem="npm")
 
# Map blast radius of a CVE
blast_radius(cve_id="CVE-2024-21538")
 
# Full agent discovery + scan
agents()
 
# Run CIS benchmark
cis_benchmark(provider="aws")
 
# Run AISVS v1.0 compliance
aisvs_benchmark()
 
# Scan vector databases for auth misconfigurations
vector_db_scan()
 
# Discover GPU containers, K8s GPU nodes, and unauthenticated DCGM endpoints
gpu_infra_scan()
 
# Scan instruction files and then inspect trust
skill_scan(path=".")
skill_trust(skill_path="./SKILL.md")

Guardrails

Always do:

• Show CVEs even when NVD analysis is pending or severity is unknown — a CVE ID with no details is still a real finding. Report what is known; mark severity as unknown explicitly.
• Confirm with the user before scanning cloud environments (cis_benchmark) — these make live API calls to AWS/Azure/GCP using the user's credentials.
• Treat UNKNOWN severity as unresolved, not benign — it means data is not yet available, not that the issue is minor.

Never do:

• Do not modify any files, install packages, or change system configuration. This skill is read-only.
• Do not transmit env var values, credentials, or file contents to any external service. Only package names and CVE IDs leave the machine.
• Do not invoke agents() autonomously on sensitive environments without user confirmation. The autonomous_invocation policy is restricted.

Stop and ask the user when:

• The user requests a cloud CIS benchmark and no cloud credentials are configured.
• A scan finds CRITICAL CVEs — present findings and ask whether to generate a remediation plan.
• The user asks to scan a path outside their home directory.

Supported Frameworks (15)

• OWASP LLM Top 10 (2025) — prompt injection, supply chain, data leakage
• OWASP MCP Top 10 — MCP-specific security risks
• OWASP Agentic Top 10 — tool poisoning, rug pulls, credential theft
• MITRE ATLAS — adversarial ML threat framework
• MITRE ATT&CK Enterprise — adversary techniques tagged via CWE → CAPEC → ATT&CK on every blast-radius finding
• NIST AI RMF — govern, map, measure, manage lifecycle
• NIST CSF 2.0 — identify, protect, detect, respond, recover
• NIST 800-53 Rev 5 — federal security controls (CM-8, RA-5, SI-2, SR-3)
• FedRAMP Moderate — derived from NIST 800-53 controls
• EU AI Act — risk classification, transparency, SBOM requirements
• ISO 27001:2022 — information security controls (Annex A)
• SOC 2 — Trust Services Criteria
• CIS Controls v8 — implementation groups IG1/IG2/IG3
• CMMC 2.0 — cybersecurity maturity model (Level 1-3)
• PCI DSS v4.0 — payment-card data security requirements

OWASP AISVS v1.0 ships as a benchmark surface alongside the tag-mapped frameworks (9 verification checks).

Privacy & Data Handling

This skill installs agent-bom from PyPI. Verify the redaction behavior before running with any config files:

# Step 1: Install
pip install agent-bom
 
# Step 2: Review redaction logic BEFORE scanning
# sanitize_env_vars() redacts credential-like and sensitive env values before
# reporting; benign configuration values may remain in the in-memory model:
# https://github.com/msaad00/agent-bom/blob/main/src/agent_bom/security.py
 
# Step 3: Review config parsing — only structural data extracted:
# https://github.com/msaad00/agent-bom/blob/main/src/agent_bom/discovery/__init__.py
 
# Step 4: Verify package provenance (Sigstore)
agent-bom verify agent-bom
 
# Step 5: Only then run scans
agent-bom scan

What is extracted: Server names, commands, args, and URLs from MCP client config files across 29 first-class client types. Credential-like and sensitive environment values are replaced with ***REDACTED*** by sanitize_env_vars() before reporting; benign configuration values may remain in the in-memory model. Only public package names and CVE IDs are sent to vulnerability databases. Cloud CIS checks use locally configured credentials and call only the cloud provider's own APIs.

Verification

• Source: github.com/msaad00/agent-bom (Apache-2.0)
• Sigstore signed: agent-bom verify agent-bom@0.103.1
• 7,100+ tests with CodeQL + OpenSSF Scorecard
• No telemetry: Zero tracking, zero analytics