This MCP server provides read-only AI supply-chain security analysis: scanning, vulnerability checks, SBOM generation, policy/compliance evaluation, remediation planning, and exposure-path investigation.
Run static, read-only security scans of local projects/configs, public git repos, Docker images, existing SBOMs, packages/MCP launch commands, or auto-discovered local MCP clients.
Return AI-BOM results with package/agent counts, findings by severity/category, affected paths, result IDs, and paged sections such as findings, packages, blast radius, and exposure paths.
Check individual packages for known CVEs across ecosystems, with optional offline/local advisory database use.
Look up CVE/GHSA/OSV advisories from the local threat-intel database.
Generate CycloneDX or SPDX SBOMs for AI agent and MCP server setups.
Evaluate security policies and compliance posture against persisted evidence or a labelled local scan.
Generate remediation plans with package fixes, credential-scope guidance, and unfixable items.
Rank and filter exposure/attack paths by KEV, severity, risk, credentials, graph nodes, and scan history.
Export or format results as JSON, SARIF, CycloneDX, SPDX, JUnit, CSV, or markdown; optionally enrich with NVD/EPSS/KEV, OpenSSF Scorecard, and integrity checks.
Scans AWS cloud infrastructure and Amazon Q configurations to identify security vulnerabilities and ensure compliance with CIS benchmarks.
Integrates with ClickHouse to provide security scan analytics, visualization, and posture scoring for AI infrastructure.
Performs security scanning of Databricks environments to detect misconfigurations and dependency vulnerabilities.
Scans Docker images and Docker-based MCP servers for security risks, tool poisoning, and dependency vulnerabilities.
Integrates as a CI/CD gate to automate security scans and enforce compliance policies during the development lifecycle.
Supports deployment and fleet-wide security scanning of AI agent infrastructure within Kubernetes using Helm charts.
Discovers and analyzes JetBrains AI configurations to identify potential credential leaks and security risks.
Enables dispatching security alerts and vulnerability findings to Jira for incident management and remediation tracking.
Scans Kubernetes clusters to map vulnerability propagation and assess the security posture of AI agent deployments.
Discovers and scans MLflow platforms to identify security risks and verify the provenance of AI models.
Provides integration with OpenTelemetry for monitoring and tracing the security scan pipeline and execution.
Dispatches real-time security alerts and scan reports to Slack channels via webhooks for immediate notification.
Provides governance and security scanning for Snowflake instances, including compliance checks against CIS Snowflake benchmarks.
Generates standardized Software Bill of Materials (SBOM) reports in the SPDX format for security compliance and transparency.
Analyzes security risks and maps the blast radius for AI agent tools and MCP servers utilizing SQLite databases.
For AppSec teams and developers who run Claude Code, Cursor, Codex or any MCP client: see which agents, MCP servers, tools and packages are installed, which are vulnerable, and what each one can reach. Local scans need no account.
From the repository you want to inspect, with uv installed:
uvx agent-bom scan . -f html -o agent-bom-report.htmlOpen agent-bom-report.html for inventory, findings and fix guidance. Run it
again later to see what changed. No MCP configuration in the project? Package
findings still apply.
No project handy? uvx agent-bom scan --demo --offline scans a bundled sample.
Exit 1 is expected there: the sample trips the security gate. Elsewhere, a
non-zero exit can mean a security gate or incomplete assessment; inspect the
report and coverage (exit codes,
first-run guide).
The scan stays inside this repository: packages, MCP configuration, secrets and personal data, skills and IaC. It does not read agent configuration elsewhere on the machine. Missing evidence is reported as partial, not clean. See what a scan does and does not establish.
Related MCP server: agent-audit
On your laptop: uvx agent-bom scan . for findings with fixes and a delta
on every rescan; claude mcp add agent-bom -- uvx agent-bom mcp server to use
agent-bom as a tool inside your coding agent (MCP server, plugins).
In your team: uses: koda-ai-studio/agent-bom@v0 on pull requests and a
weekly schedule: for a PR gate with a findings comment, SARIF in code
scanning and a weekly rescan that catches new CVEs in unchanged code
(GitHub Action).
Across your org: agent-bom up locally, then Docker Compose or the Helm
chart from oci://ghcr.io/koda-ai-studio/charts/agent-bom for retained scans,
one graph of agents, MCP servers, packages and credentials, SSO and audit in
your own infrastructure (self-host).
All three are free under Apache-2.0 and are adoption paths, not editions. There is no managed cloud offering today; community support runs on GitHub (deployment chooser, support model).
A CVE in an AI package, a poisoned tool description or an over-scoped credential matters by what the agent that loads it can reach. A package SBOM stops at packages; agent-bom records the chain, agent → MCP server → tool → package → credential → data, and keeps the evidence for every edge.
Sample data. What the sample shows
Agents and MCP servers, models and AI platforms, dependencies, code, containers and IaC, cloud and data platforms, and a runtime MCP proxy and gateway. Exports are SARIF, CycloneDX, SPDX, JSON and HTML.
Area | What you get |
AI agents and MCP | Agents, MCP servers, tools and credentials from local configs and agent frameworks, linked to what they can reach. |
Models and AI platforms | Supported OpenAI, Hugging Face, Ollama, MLflow and W&B assets, with available model provenance beside dependencies and agent context. |
Runtime | An MCP proxy and gateway that alert on poisoned tools and injected results, or block them with |
SBOM, AI-BOM and Agent-BOM | Software SBOMs in CycloneDX or SPDX. CycloneDX AI components carry collected model metadata. Native agent-bom JSON connects agents, MCP servers, tools, credential references and packages. |
Dependencies | Lockfiles and manifests across Python, JavaScript, Go, Java, .NET, Rust and more, matched against OSV, GitHub advisories and NVD with KEV and EPSS. |
Code | Findings imported from any SARIF producer, plus native analysis of AI code (prompt-injection sinks, guardrails, tool exposure) and whether your code reaches the vulnerable function. |
Containers and IaC | Images scanned in bounded memory and time; Dockerfile, Terraform, Kubernetes, Helm and compose risks with exact lines in SARIF. |
Cloud and data platforms | Read-only collection from AWS, Azure, GCP, Kubernetes, Databricks and Snowflake, with provider-specific posture checks and graph context. Per-lane rule counts are generated from code in the capability matrix. |
GPU and AI infrastructure | AI workloads on CoreWeave, Nebius, Lambda, RunPod, Vast.ai and Crusoe; GPU containers and Kubernetes GPU nodes. Collection depth varies by provider. |
Findings map to OWASP LLM Top 10, OWASP Agentic Top 10, OWASP MCP Top 10, MITRE ATLAS, EU AI Act and NIST AI RMF.
Generate a BOM from a project, or inspect an agent inventory with sample data:
agent-bom scan --project . -f cyclonedx -o sbom.cdx.json
agent-bom scan --project . -f spdx -o sbom.spdx.json
agent-bom scan --demo --offline -f json -o agent-bom.jsonModel metadata appears when the source supplies it.
Area | Integrations |
AI clients + IDEs | Claude, Codex, Cursor, GitHub Copilot, Windsurf, Cortex Code, Gemini CLI, JetBrains AI, Junie, Amazon Q, Cline, Roo Code, Continue, Zed, Goose, Snowflake CLI, Docker MCP Toolkit, Tabnine, Sourcegraph Cody, Aider, Void, Aide, Trae, Pieces, OpenClaw, mcp-cli |
AI platforms + model hubs | OpenAI, Hugging Face, Ollama, MLflow, W&B, Langfuse, LangSmith |
GPU + neo clouds | CoreWeave, Nebius, Lambda, RunPod, Vast.ai, Crusoe, GPU containers + K8s GPU nodes |
Hyperscalers + Kubernetes | AWS, Azure, GCP, Kubernetes |
Data + vector stores | Snowflake, Databricks, Supabase, Pinecone, Qdrant, Weaviate, Chroma, Milvus |
Identity + SaaS + dev | Okta, GitHub Actions, Vercel, Microsoft Entra ID, Jira, ServiceNow, Slack, Jamf |
Evidence out | ClickHouse, BigQuery, S3, GCS, Azure Blob, Jira tickets, Slack alerts, Vanta, Drata, OCSF syslog |
Product names and logos are trademarks of their owners, used only to identify supported evidence sources. Their use does not imply endorsement or partnership.
Select an agent such as Document Intake Agent, open CVE-2023-4863 (high, KEV-listed) and follow each arrow back to its source evidence. Take the proposed remediation, then rescan the changed pin and compare snapshots; the comparison verifies the changed input, not a running deployment.
Match it against stored scans, including CVEs only NVD has published. You get affected assets with their patch target, possibly affected distro packages to verify, and the blast radius (walkthrough):
agent-bom db update # refresh OSV, NVD, KEV and EPSS
agent-bom db advisory affected CVE-2026-109618 # most recent saved scan
agent-bom db advisory affected CVE-2026-109618 --report <scan-report.json> --format json # a JSON report written by an earlier scanFrom an MCP client, the read-only affected_assets tool (graph and full
profiles) takes the same advisory_id. In CI, run uvx agent-bom db update
before the GitHub Action step (its auto-update-db default only refreshes
feeds that missed the daily freshness target). To explain a finding to your team,
create an impact brief.
One package, three parsed inputs. A repository pin, an image SBOM and a
modeled Kubernetes workload resolve to one pillow@9.0.0.
Repository. Source imports, deployment configuration and CI traced to a published container and its vulnerable packages:
Cloud. A public API gateway into a vulnerable workload, its role and a PII bucket:
Sample data. Context, correlation and reachability · Run the reference lab · Reproduce these screenshots
Try the demo in your browser on labelled sample data, with no install. To open the same graph locally:
pip install 'agent-bom[ui]==0.114.0'
agent-bom quickstart --run --offlineRun the server command it prints, then open its graph URL. Offline quickstart skips package-CVE lookup, so zero CVEs is not a clean verdict; use the bundled demo for advisory-backed findings or populate the advisory database.
Your infrastructure, identity, database and audit boundary. Start a local pilot from a published release checkout:
git clone --depth 1 --branch v0.114.0 https://github.com/koda-ai-studio/agent-bom.git && cd agent-bom
AGENT_BOM_IMAGE_TAG=0.114.0 docker compose up -dOpen http://localhost:3000, then Connections or New Scan. The pilot binds to loopback and retains state in a Docker volume. Before sharing access, move to the authenticated deployment.
Deployment | First step | Result and next step |
CLI or CI job |
| Labelled sample findings in JSON; scan your own inventory or configure a CI gate. |
Local API and dashboard |
| Sample report and persisted graph; run the printed loopback server command and open its graph URL. |
Docker Compose pilot | Release checkout and | Loopback API/UI with retained state; connect a read-only source and run a scan. |
Authenticated single host | Login-gated API/UI and PostgreSQL; configure TLS, identity, secrets and backups before sharing access. | |
Kubernetes / EKS | Control plane in your cluster; provision role-separated secrets and storage, then validate authentication and health. |
For cloud accounts, add a scoped read-only connection, verify access, then start a scan.
Modes can be combined:
Mode | What it does | Start |
Scan | Collect inventory and findings on demand or in CI; retain reports and graph evidence. | |
Fleet inventory | Endpoints or collectors sync inventory to the control plane; review last-seen evidence. | |
MCP server |
| |
Runtime proxy | Wrap selected local stdio MCP servers to inspect tool calls; verify decisions in the audit trail. | |
Runtime gateway | Relay selected remote MCP traffic through a shared service; validate client auth, policy and upstream connectivity. |
Sources describes recorded evidence: local scans, fleet inventory, cluster scans, CI/CD, imported evidence, or mixed sources. It does not select a deployment type or enable runtime enforcement. Demo data marks labelled sample inventory.
Assets are inventoried resources; Findings are detections on those resources; Issues group related findings for investigation or remediation.
Affected assets counts distinct resources only when that count is available. One finding may belong to several security areas, so area counts must not be summed. Repeated observations across scans are shown separately.
Preview and community deployment paths have separate support boundaries.
Docker pilot guide · Compose with PostgreSQL · Choose a deployment · Enterprise controls · Connect cloud accounts
In Claude Code:
/plugin marketplace add koda-ai-studio/agent-bom
/plugin install agent-bom@agent-bomIn Codex, run codex plugin marketplace add koda-ai-studio/agent-bom, then
install agent-bom-local from the Plugins Directory. Both plugins run the
pinned agent-bom release locally and send nothing to an agent-bom service.
Ask | Skill |
"Is this project safe to ship?" |
|
"Am I affected by CVE-2025-29927?" |
|
"What have my agents been doing?" |
|
"Are my agent settings too permissive?" |
|
"Give me an AI-BOM" |
|
Add /plugin install agent-bom-guard@agent-bom to block malicious and
typosquatted package installs before Claude runs them.
All skills and their permissions ·
Guard details
Use CLI or GitHub Action, REST API, or MCP; export SARIF, CycloneDX, SPDX, JSON and HTML. Cloud connectors and fleet sync collect inventory; proxy and gateway deployments add runtime evidence.
For other MCP clients, run agent-bom mcp server.
Start with eight focused tools in the default profile.
Choose an MCP profile for graph, cloud, runtime or audit work.
Try three investigations: affected agents, exposure receipts and a before/after scan comparison.
Import existing scanner reports without replacing their source evidence.
Check a dependency before installing it with
uvx agent-bom check requests@2.33.0 --ecosystem pypi. Add
pre-commit and CI setup for repeated checks.
Proxy, gateway and fleet · Integration capability matrix · MCP client setup · Smithery migration
The GitHub Action writes a job summary with severity counts, the top findings
and their fixes, and says when a scan was partial. To link your README to your
own workflow, add a standard GitHub workflow badge (replace OWNER/REPO and the
workflow file name); the Action's badge: input also writes shields.io badge JSON:
[](https://github.com/OWNER/REPO/actions/workflows/agent-bom.yml)Discovery uses read-only access by default. Explicit disk side-scans create temporary cloud resources. Missing evidence stays unavailable or partial; control mappings are not audit certification.
Screenshots use sample data; what the sample shows covers which links are modeled rather than observed.
Retained scans correlate by exact, tenant-scoped identities.
A graph path does not prove exploitation. Credential references are names, not secret values.
Persisted runtime, proxy and gateway activity retains source receipts and bounded time windows in the graph. Exact inventory references can bind records; unresolved identities and collection gaps remain explicit. Recorded activity does not prove execution or grant access. See the runtime evidence boundaries.
MITRE technique associations provide investigation context, not proof of an attack. ATLAS mapping receipts retain the weakness association and source catalog hashes.
A BOM is an inventory, not proof of safe execution or complete collection.
Measured matcher proof · Product boundaries · Permissions · Threat model · Release verification · Graph data model
Start with the first PR guide
or a good first issue.
Ask in GitHub Discussions (or Discord), share feedback,
or follow the maintainer path (review owners).
Contributing · Capabilities and roadmap · Support · Report an inaccurate finding · Apache-2.0
Source version: v0.115.0 · Latest release: v0.114.0 · Changelog
Check a specific package for known CVEs before installing.
Queries OSV.dev for vulnerabilities in the given package. Use this
before installing an MCP server or dependency to verify it is safe.
Args:
package: Package name with optional version, e.g. "express@4.18.2",
"@modelcontextprotocol/server-filesystem@2025.1.14",
or just "requests" (resolves @latest).
ecosystem: Package ecosystem — "npm", "pypi", "go", "cargo",
"maven", "nuget", "rubygems", "composer", "swift",
"pub", "hex", "conda", "deb", "apk", or "rpm".
Defaults to "npm".
Returns:
JSON with package, version, ecosystem, vulnerability count,
and vulnerability details (id, severity, cvss, fix version, summary).
Inputs: package (required), offline, version, ecosystem. Returns: result
Return compliance posture with its source: the tenant's persisted evidence, or a labelled local scan.
With completed scans in the control plane, ``summary`` is exactly
``/v1/compliance/summary``; ``framework`` adds ``/v1/compliance/{framework}``
and ``control`` pages the driving finding ids from
``/v1/findings?framework=&control=``. Otherwise (or with
source='local_scan') it scans local MCP configurations and labels that scope.
Inputs: image, limit, cursor, source, +4 more. Returns: result
Return the attack-path queue in the dashboard's order, with why each path ranks where it does.
Ranking is ``ranking.order`` (evidence tier, KEV, severity, evidence confidence,
composite risk, credential count); every path carries ``rank``, ``evidenceTier``,
``isKev``, ``severity``, ``evidenceConfidence`` and ``rankingFactors``. Totals,
filters and cursor pages match ``/v1/graph/attack-paths``. With ``result_id`` the
paths are that session scan result's, unfiltered and labelled ``session_scan_result``.
Inputs: kev, view, limit, cursor, +11 more. Returns: result
Generate a Software Bill of Materials (SBOM) for your AI agent setup.
Discovers AI agents and MCP servers, extracts all package dependencies,
and generates a standards-compliant SBOM.
Args:
format: SBOM format — "cyclonedx" (CycloneDX 1.7) or "spdx" (SPDX 3.0).
config_path: Path to a specific MCP config directory.
If not provided, auto-discovers all local agent configs.
Returns:
JSON string containing the SBOM in the requested format.
Inputs: format, config_path. Returns: result
Look up one advisory from the local threat-intel database.
Inputs: advisory_id (required). Returns: result
Evaluate a security policy against current scan results.
Runs a scan, then evaluates the provided policy rules against the
findings. Policies can gate on severity thresholds, CISA KEV status,
AI risk flags, credential exposure, and denied packages.
Args:
policy_json: JSON string containing policy rules. Example:
{"rules": [{"id": "no-critical", "severity_gte": "critical",
"action": "fail"}, {"id": "no-kev", "kev": true, "action": "fail"}]}
Returns:
JSON with passed (bool), violations list, failure_count, and
warning_count.
Inputs: policy_json (required). Returns: result
Generate a remediation plan for vulnerabilities in your AI agent setup.
Scans for vulnerabilities, then generates actionable fix commands for
each affected package (npm install, pip install), credential scope
reduction guidance, and reports on unfixable vulnerabilities.
Args:
config_path: Path to a specific MCP config directory.
If not provided, auto-discovers all local agent configs.
image: Docker image reference to scan (e.g. "nginx:1.25").
Returns:
JSON with package_fixes (upgrade commands by ecosystem),
credential_fixes (scope reduction steps), and unfixable items.
Inputs: image, config_path. Returns: result
Run a full AI supply chain security scan and return an AI-BOM.
Point it at a target with one of:
• project_path — a local project / repo directory ("scan this repo";
must be inside home or AGENT_BOM_MCP_WORKSPACE_ROOTS)
• repo_url — a public git repo URL (cloned + scanned, no checkout)
• config_path — a local MCP-config directory
• image — a Docker image
• sbom_path — an existing CycloneDX/SPDX SBOM
• package — a single package or MCP launch command (pair it with
ecosystem when the spec names no launcher)
With none of these, it auto-discovers local MCP clients (Claude Desktop,
Cursor, Windsurf, VS Code Copilot, OpenClaw, etc.).
It extracts package dependencies, looks up CVEs (online via OSV.dev and advisory sources unless offline mode is requested or configured), assesses config security (credential exposure, tool access), computes blast radius, and returns structured results. Scanning is fully static and read-only — repository and image contents are parsed, never executed.
Returns: JSON. By default a bounded summary: counts (packages, agents, findings by severity/category), top findings, affected paths, and a result_id. Page any full-fidelity section with scan(result_id=..., section='findings', offset=0, limit=25). An incomplete scan (e.g. vulnerability source unavailable) is returned as an error result whose body is still JSON.
Inputs: image, limit, detail, enrich, +20 more. Returns: result
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 8 tools
Most tools target clearly distinct outputs: scan (full assessment), check (single package CVE lookup), compliance, policy_check, remediate, exposure_paths, intel_lookup. The main confusion is between scan and generate_sbom, since scan already returns an 'AI-BOM' and affected paths while generate_sbom returns a standards-compliant SBOM, plus mild overlap between check (OSV package CVEs) and intel_lookup (local advisories). Descriptions help but an agent could easily pick the wrong one for a 'give me an SBOM' request.
Names are all snake_case (one word or two), so character style is uniform, but the verb/noun convention is mixed: bare verbs (scan, check, remediate), noun phrases (exposure_paths, compliance), and odd compounds (intel_lookup, policy_check). Readable in aggregate but not a predictable verb_noun pattern.
Eight tools is a sensible scope for a supply-chain security server. Several tools (scan, remediation, policy_check, compliance, generate_sbom) internally re-run the same scan, so there is a bit of functional redundancy, but none feels wholly unjustified.
Covers discovery/scanning, package CVE check, SBOM export, compliance, attack-path ranking, policy gating, and remediation — a strong lifecycle. Gaps remain: no scan history/session listing, no diff/compare between scans, no finding suppression/waiver or credential inventory tool, and result paging is only reachable through scan.
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
Security scanner for AI agents and MCP servers: injection, jailbreak, tool abuse.
AWS cloud security scanners for AI agents — S3, IAM, EC2, EKS, RDS, CloudTrail, CloudWatch Logs