Security Scan
scanRead-onlyIdempotent
Run an AI supply chain security scan that discovers MCP configurations, extracts dependencies, detects vulnerabilities, assesses credential exposure, and computes blast radius for actionable remediation.
Instructions
Run a full AI supply chain security scan.
Discovers local MCP configurations (Claude Desktop, Cursor, Windsurf,
VS Code Copilot, OpenClaw, etc.), extracts package dependencies, queries
OSV.dev for CVEs, assesses config security (credential exposure, tool access),
computes blast radius, and returns structured results.
Returns:
JSON with the complete AI-BOM report including agents, packages,
vulnerabilities, blast radius, and remediation guidance.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| config_path | No | Path to MCP client config directory. Auto-discovers all if omitted. | |
| image | No | Docker image to scan (e.g. 'nginx:1.25', 'ghcr.io/org/app:v1'). | |
| sbom_path | No | Path to existing CycloneDX or SPDX JSON SBOM file to ingest. | |
| package | No | Direct package or MCP launch command to scan, e.g. 'npx @modelcontextprotocol/server-filesystem@2025.1.14' or '@modelcontextprotocol/server-filesystem'. | |
| enrich | No | Enable NVD CVSS, EPSS probability, and CISA KEV enrichment. | |
| offline | No | Use the local vulnerability DB only and skip registry, OSV, GHSA, and NVIDIA network lookups. | |
| scorecard | No | Enrich packages with OpenSSF Scorecard scores (requires resolvable GitHub repos). | |
| transitive | No | Resolve transitive dependencies for npx/uvx packages. | |
| verify_integrity | No | Verify package SHA-256/SRI hashes and SLSA provenance against registries. | |
| fail_severity | No | Return failure status if vulns at this severity or higher: critical, high, medium, low. | |
| warn_severity | No | Return warning status (gate_status=warn, exit 0) when vulns at this severity or higher exist. Use with fail_severity for two-tier CI gates, e.g. warn_severity='medium', fail_severity='critical'. | |
| auto_update_db | No | Explicitly refresh the local vuln DB when older than the daily freshness target before scanning. | |
| db_sources | No | Comma-separated DB sources to sync before scanning (e.g. 'nvd,ghsa,osv,epss,kev'). | |
| output_format | No | Output format: 'json' (default), 'sarif', 'cyclonedx', 'spdx', 'junit', 'csv', or 'markdown'. | json |
| policy | No | Policy object to evaluate alongside scan results, e.g. {"rules": [{"id": "no-critical", "severity_gte": "critical", "action": "fail"}]}. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |