mcpField
A
agent-bom

agent-bom

Local
github.com/koda-ai-studioSecurity35Updated today
Repository

About agent-bom

agent-bom is an open security scanner and self-hosted control plane for AppSec and platform engineers working with AI agents, MCP, and cloud infrastructure. It correlates scan findings with asset relationships and evidence to help assess exposure, coverage gaps, and remediation priorities.

Key features

  1. 01Scan repositories, AI agents, and cloud assets
  2. 02Correlate findings with infrastructure context
  3. 03Trace blast radius and evidence sources
  4. 04Produce remediation guidance and reports
  5. 05Apply policies to tool calls via proxy or gateway

Use cases

  1. 01Assess the impact of vulnerable agent dependencies
  2. 02Compare scan snapshots after dependency changes
  3. 03Export reports and gate CI on findings
  4. 04Review policies for MCP tool calls

MCP support

Provides an MCP server for security investigation tools through `agent-bom mcp server`. MCP profiles can be selected for graph, cloud, runtime, or audit work.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "koda-ai-studio-agent-bom": {
      "command": "uvx",
      "args": [
        "agent-bom"
      ],
      "env": {
        "NVD_API_KEY": "<NVD_API_KEY>"
      }
    }
  }
}
Run commanduvx agent-bom
Environment variables to set
NVD_API_KEYSecretNVD API key for higher rate limits on vulnerability enrichment

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
pypiagent-bom0.111.0

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

agent-bom — Discover. Scan. Correlate. Act. Security evidence across repositories, software supply chains, AI and MCP, cloud, identity, and data.

Build PyPI Python 3.11 through 3.14 Docker pulls Apache-2.0 license OpenSSF Scorecard Glama MCP server Smithery MCP server

Find vulnerable software behind your AI agents—and trace the exposure evidence.

For AppSec and platform engineers responsible for AI agents and MCP servers: scan a repository, correlate its findings with agent and infrastructure context, and prioritize fixes using blast radius and reachability evidence. Explain what is affected, what the evidence supports, and which action needs review. Open security scanner and self-hosted control plane for AI, MCP, and cloud infrastructure. Local scans need no account.

Quick start · Sample graph · Self-host · Product tour · Docs

Quick start

From the repository you want to inspect:

pip install agent-bom
agent-bom scan .

Read the inventory, findings, coverage gaps, and remediation guidance in the terminal. Save a report with agent-bom scan . -f sarif -o findings.sarif, then upload it and gate CI. Run agent-bom doctor if setup fails. See the first-run guide.

No project handy? Run agent-bom scan --demo --offline for a bundled sample. Exit 1 is expected: the sample trips the security gate. A non-zero exit can mean a security gate or incomplete assessment; inspect the report and coverage. See the exit codes.

Recorded agent-bom CLI showing sample findings and remediation guidance; no fix executed

The recording uses labeled sample data and bundled advisories. Credential references are names, not secret values. Recorded relationships do not prove exploitation or successful data access.

Investigate context and exposure

Which agent uses the vulnerable component? What could it reach? What evidence supports that path? Correlate retained scans by exact, tenant-scoped identities; trace the recorded blast radius from each agent through its MCP servers to packages, findings, credentials and data stores. Inspect each relationship's source and evidence kind, then rescan the same scope to check what changed.

Sample production AI environment: Document Intake Agent uses a document-tools MCP server that depends on pillow 9.0.0, linked to KEV-listed CVE-2023-4863; Support Triage Agent uses a ticketing MCP server that references TICKETING_API_KEY, which can access a customer ticket archive

Fictional sample estate. Dashed use, credential and access links are configured or modeled, not observed at runtime; path analysis covers the collected snapshot only.

From agent to verified fix: select Document Intake Agent → inspect CVE-2023-4863 (high, KEV-listed) and the evidence on each arrow → take the proposed remediation → rescan the changed pin and compare snapshots. The comparison verifies the changed input, not a running deployment.

Supporting evidence: one package, three parsed inputs. A repository pin, an image SBOM and a modeled Kubernetes workload resolve to one [email protected]. The image inventory and the deployment occurrence stay separate nodes; the advisory receipt is open.

Repository pin, image inventory and Kubernetes deployment occurrence resolving to one pillow package linked to KEV-listed CVE-2023-4863, with the plain-language relationship evidence open

Real parsers, modeled infrastructure; a graph path does not prove exploitation.

Explore context, correlation and reachability · Run the reference lab · Reproduce these screenshots

Explain a finding to your team: create an impact brief with affected assets, source receipts, evidence gaps and the next action to review.

Repository and cloud investigations

Trace source imports, deployment configuration and CI to a published container and its vulnerable packages:

Sample repository linking source, deployment configuration and a CI job to a container, vulnerable npm and PyPI packages, their advisories and a CI misconfiguration

Follow a public API gateway into a vulnerable workload, its role and a PII bucket:

Sample cloud account where a public API gateway exposes a workload with a critical advisory that authenticates as a role permitted to read a PII bucket

Open the sample graph

pip install 'agent-bom[ui]==0.110.0'
agent-bom quickstart --run --offline

Run the server command it prints, then open its graph URL. Offline quickstart skips package-CVE lookup, so zero CVEs is not a clean verdict; use the bundled demo for advisory-backed findings or populate the advisory database.

Self-host in your environment

Your infrastructure, identity, database, and audit boundary. Start a local pilot from a published release checkout:

git clone --depth 1 --branch v0.110.0 https://github.com/koda-ai-studio/agent-bom.git && cd agent-bom
AGENT_BOM_IMAGE_TAG=0.110.0 docker compose up -d

Open http://localhost:3000, then Connections or New Scan. The pilot binds to loopback and retains state in a Docker volume. For cloud accounts, add a scoped read-only connection, verify access, then start a scan. Use the authenticated deployment.

  • Scan with CLI or CI; export findings, SBOMs and reports.
  • Centralize inventory, graph evidence, remediation and compliance in your own control plane.
  • Enforce policy on selected live MCP tool calls through the proxy or gateway.

Docker pilot guide · Compose with PostgreSQL · Choose a deployment · Enterprise controls · Connect cloud accounts

Work with your existing tools

Use CLI or GitHub Action, REST API, or MCP; export SARIF, CycloneDX, SPDX, JSON and HTML. Cloud connectors and fleet sync collect inventory; proxy and gateway deployments add runtime evidence.

For coding assistants, run agent-bom mcp server. In Claude Code, install the plugin with /plugin marketplace add koda-ai-studio/agent-bom then /plugin install agent-bom@agent-bom (details). Add /plugin install agent-bom-guard@agent-bom to block malicious and typosquatted package installs before Claude runs them (details). Start with eight focused tools in the default profile. Choose an MCP profile for graph, cloud, runtime or audit work. Try three investigations: affected agents, exposure receipts and a before/after scan comparison. Import existing scanner reports without replacing their source evidence.

Prefer an isolated invocation? Use uvx agent-bom scan . or check a dependency with uvx agent-bom check [email protected] --ecosystem pypi. Add pre-commit and CI setup for repeated checks.

Proxy, gateway and fleet · Integration capability matrix · MCP client setup · Smithery setup and manifest

Trust and evidence

Discovery uses read-only access by default. Explicit disk side-scans create temporary cloud resources. Missing evidence stays unavailable or partial; control mappings are not audit certification.

MITRE technique associations provide investigation context, not proof of an attack. ATLAS mapping receipts retain the weakness association and source catalog hashes; modeled graph paths do not establish observed execution or effective access.

Measured matcher proof · Product boundaries · Permissions · Threat model · Release verification · Graph data model

Contributing and support

Contributing · Capabilities and roadmap · Support · Report an inaccurate finding · Apache-2.0

Source version: v0.110.0 · Latest release: v0.110.0 · Changelog

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.