Security Scan
scanRead-onlyIdempotent
Discover local MCP configurations, extract package dependencies, query CVEs, assess config security, compute blast radius, and return a structured AI-BOM report with vulnerabilities and remediation guidance.
Instructions
Run a full AI supply chain security scan.
Discovers local MCP configurations (Claude Desktop, Cursor, Windsurf,
VS Code Copilot, OpenClaw, etc.), extracts package dependencies, queries
OSV.dev for CVEs, assesses config security (credential exposure, tool access),
computes blast radius, and returns structured results.
Returns:
JSON with the complete AI-BOM report including agents, packages,
vulnerabilities, blast radius, and remediation guidance.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| config_path | No | Path to MCP client config directory. Auto-discovers all if omitted. | |
| image | No | Docker image to scan (e.g. 'nginx:1.25', 'ghcr.io/org/app:v1'). | |
| sbom_path | No | Path to existing CycloneDX or SPDX JSON SBOM file to ingest. | |
| enrich | No | Enable NVD CVSS, EPSS probability, and CISA KEV enrichment. | |
| offline | No | Use the local vulnerability DB only and skip registry, OSV, GHSA, and NVIDIA network lookups. | |
| scorecard | No | Enrich packages with OpenSSF Scorecard scores (requires resolvable GitHub repos). | |
| transitive | No | Resolve transitive dependencies for npx/uvx packages. | |
| verify_integrity | No | Verify package SHA-256/SRI hashes and SLSA provenance against registries. | |
| fail_severity | No | Return failure status if vulns at this severity or higher: critical, high, medium, low. | |
| warn_severity | No | Return warning status (gate_status=warn, exit 0) when vulns at this severity or higher exist. Use with fail_severity for two-tier CI gates, e.g. warn_severity='medium', fail_severity='critical'. | |
| auto_update_db | No | Explicitly refresh the local vuln DB if stale (>7 days) before scanning. | |
| db_sources | No | Comma-separated DB sources to sync before scanning (e.g. 'nvd,ghsa,osv,epss,kev'). | |
| output_format | No | Output format: 'json' (default), 'sarif', 'cyclonedx', 'spdx', 'junit', 'csv', or 'markdown'. | json |
| policy | No | Policy object to evaluate alongside scan results, e.g. {"rules": [{"id": "no-critical", "severity_gte": "critical", "action": "fail"}]}. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |