agent-bom

Find vulnerable software behind your AI agents—and trace the exposure evidence.

Open security scanner and self-hosted control plane for AI, MCP, and cloud infrastructure. For AppSec and platform engineers responsible for AI agents and MCP servers: scan a repository, correlate its findings with agent and infrastructure context, and prioritize fixes by blast radius and reachability evidence. Local scans need no account.

Quick start · Integrations · Sample graph · Self-host · Product tour · Docs

Quick start

From the repository you want to inspect, with uv installed:

uvx agent-bom scan .

Read the discovered agents and MCP servers, prioritize the highest-severity findings, and follow the affected package's fix guidance. Review coverage gaps beside the verdict: incomplete evidence is not a clean assessment. What this scan does and does not establish.

Apply a reviewed fix, update the lockfile, then rerun uvx agent-bom scan . against the same repository to verify the finding changed. Save a report with uvx agent-bom scan . -f sarif -o findings.sarif, then upload it and gate CI. Run uvx agent-bom doctor if setup fails. See the first-run guide for pip installation and the existing checkup assistant workflow.

In GitHub Actions, the same scan uploads SARIF to code scanning and fails on high or critical findings, the same default gate as the CLI:

permissions:
  contents: read
  security-events: write
steps:
  - uses: actions/checkout@v4
  - uses: koda-ai-studio/agent-bom@v0
    with:
      upload-sarif: 'true'

No project handy? Run uvx agent-bom scan --demo --offline for a bundled sample. Exit 1 is expected: the sample trips the security gate. A non-zero exit can mean a security gate or incomplete assessment; inspect the report and coverage. See the exit codes.

The recording uses labeled sample data and bundled advisories. Credential references are names, not secret values. Recorded relationships do not prove exploitation or successful data access.

What it covers

Supported sources

Discovery and scanning read from these sources today; the last row lists where evidence can be sent. The list is generated from a code-backed manifest (docs/images/integrations-manifest.json); a test fails if it names anything without an implementation.

Product names and logos are trademarks of their owners, used only to identify supported evidence sources. Their use does not imply endorsement or partnership.

Investigate context and exposure

Which agent uses the vulnerable component? What could it reach? What evidence supports that path? Correlate retained scans by exact, tenant-scoped identities; trace the recorded blast radius from each agent through its MCP servers to packages, findings, credentials and data stores. Inspect each relationship's source and evidence kind, then rescan the same scope to check what changed.

Fictional sample estate. Dashed use, credential and access links are configured or modeled, not observed at runtime; path analysis covers the collected snapshot only. Open the full-size environment graph.

From agent to verified fix: select Document Intake Agent → inspect CVE-2023-4863 (high, KEV-listed) and the evidence on each arrow → take the proposed remediation → rescan the changed pin and compare snapshots. The comparison verifies the changed input, not a running deployment.

Supporting evidence: one package, three parsed inputs. A repository pin, an image SBOM and a modeled Kubernetes workload resolve to one [email protected]. The image inventory and the deployment occurrence stay separate nodes; the advisory receipt is open.

Real parsers, modeled infrastructure; a graph path does not prove exploitation. Open the full-size relationship graph.

Explore context, correlation and reachability · Run the reference lab · Reproduce these screenshots

Explain a finding to your team: create an impact brief with affected assets, source receipts, evidence gaps and the next action to review.

Am I affected by a new CVE? Respond to a new CVE: match it against stored scans, including CVEs only NVD has published, and get affected assets with their patch target, possibly affected distro packages to verify, and the blast radius.

Open the sample graph

Try the demo in your browser: a read-only copy of the UI on labelled sample data, with no install and no backend. Scans, settings and sign-in are turned off there. To open the same graph locally:

pip install 'agent-bom[ui]==0.110.0'
agent-bom quickstart --run --offline

Run the server command it prints, then open its graph URL. Offline quickstart skips package-CVE lookup, so zero CVEs is not a clean verdict; use the bundled demo for advisory-backed findings or populate the advisory database.

Self-host in your environment

Your infrastructure, identity, database, and audit boundary. Start a local pilot from a published release checkout:

git clone --depth 1 --branch v0.110.0 https://github.com/koda-ai-studio/agent-bom.git && cd agent-bom
AGENT_BOM_IMAGE_TAG=0.110.0 docker compose up -d

Open http://localhost:3000, then Connections or New Scan. The pilot binds to loopback and retains state in a Docker volume. For cloud accounts, add a scoped read-only connection, verify access, then start a scan. Use the authenticated deployment.

• Scan with CLI or CI; export findings, SBOMs and reports.
• Centralize inventory, graph evidence, remediation and compliance in your own control plane.
• Enforce policy on selected live MCP tool calls through the proxy or gateway.

Docker pilot guide · Compose with PostgreSQL · Choose a deployment · Enterprise controls · Connect cloud accounts

Integrations

/plugin marketplace add koda-ai-studio/agent-bom
/plugin install agent-bom@agent-bom

Trust and evidence

Discovery uses read-only access by default. Explicit disk side-scans create temporary cloud resources. Missing evidence stays unavailable or partial; control mappings are not audit certification.

Persisted runtime, proxy and gateway activity retains source receipts and bounded time windows in the graph. Exact inventory references can bind records; unresolved identities and collection gaps remain explicit. Recorded activity does not prove execution or grant access. See the runtime evidence boundaries.

MITRE technique associations provide investigation context, not proof of an attack. ATLAS mapping receipts retain the weakness association and source catalog hashes; modeled graph paths do not establish observed execution or effective access.

Measured matcher proof · Product boundaries · Permissions · Threat model · Release verification · Graph data model

Contributing and support

New here? The first PR in 30 minutes guide and a ready Codespace get you from zero to a passing test without local setup. Start with a good first issue or the contributor roadmap, and ask in #contributors on Discord.

agent-bom wants more maintainers: GOVERNANCE.md lays out the path from contributor to triager, reviewer and maintainer, and MAINTAINERS.md lists who reviews what. If agent-bom gave you useful evidence, a star or a short note in feedback helps other security teams find and trust it.

Contributing · Capabilities and roadmap · Support · Report an inaccurate finding · Apache-2.0

Source version: v0.111.0 · Latest release: v0.110.0 · Changelog