securitysupply-chaincompliancesbomvulnerability-scanning
Open-source AI supply chain security scanner and control plane with 77 MCP tools and multi-ecosystem compliance enforcement.
Quick Install
Automated & IDE SetupCopy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.
Not yet automatically verified
We haven't yet run this listing's install command through our automated sandbox check. This isn't a red flag — we're steadily working through the catalog.
Manual Client & Custom JSON ConfigExpand JSON ▾
Client Config & Setup
Choose your client or environment
Target File:
💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.
Overview
Use cases
Scan AI agents, MCP servers, and dependencies for known vulnerabilities
Generate CycloneDX and SPDX Software Bill of Materials (SBOMs)
Investigate exposure paths and credential risks in AI supply chains
Enforce compliance with OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF, and EU AI Act
Integrate security scanning into CI/CD pipelines and runtime policy enforcement
Key features
Auto-discovers 20 MCP clients and supports 15 package ecosystems
Detects CVEs using OSV, NVD, EPSS, and CISA KEV databases
Maps blast radius from vulnerabilities to exposed credentials and tools
Runs CIS benchmarks and compliance checks across 16 compliance surfaces
Generates CycloneDX and SPDX SBOM formats
Provides a unified graph model correlating static and runtime evidence
Capabilities & Tool Schemas
Inspect callable tools, capabilities, and parameters exposed to AI agents by Agent Bom.
Extracted Tool Capabilities
Auto-discovers 20 MCP clients and supports 15 package ecosystems
Detects CVEs using OSV, NVD, EPSS, and CISA KEV databases
Maps blast radius from vulnerabilities to exposed credentials and tools
Runs CIS benchmarks and compliance checks across 16 compliance surfaces
Generates CycloneDX and SPDX SBOM formats
Provides a unified graph model correlating static and runtime evidence
Documentation Overview
Open security scanner and self-hosted control plane for AI, MCP, and cloud infrastructure.
Product tour · Self-host · Quick start · Docs
Built for the teams that build, secure and govern AI
| Your team | What you can do |
|---|---|
| Developers & AI engineers | Inspect repositories, dependencies and MCP configuration; bring findings into CI and coding assistants. |
| AppSec & cloud security | Connect cloud accounts, trace findings through workloads and identities, and prioritize fixes by reachable impact. |
| Platform & DevOps | Run a shared control plane, collect fleet evidence, and apply policy to MCP traffic through the proxy or gateway. |
| GRC & audit | Open Compliance to review mappings and export scan evidence with its source, freshness and assessment gaps. |
| Security & engineering leaders | Open Overview to review posture, remediation priorities and tracked AI spend across connected sources. |
| AI assistants & automation | Use MCP workflows to query evidence and inspect findings within the caller’s permissions. |
Product tour
Security and engineering leaders: decide what needs attention
See the current risk posture, critical findings, assessment coverage and tracked AI spend together. Open the underlying evidence before assigning a priority.
AppSec and cloud teams: explain why a finding matters
Follow CVE-2023-4863 in pillow@9.0.0 from its service and container through the tool, workload identity and reachable data asset. Inspect the source receipts and carry the selected finding into remediation.
Engineers and GRC: prioritize findings and verify fixes
Review findings by priority, affected asset, detection evidence and available fix. Open remediation to compare package upgrades and mapped controls, assign owners, set SLAs and re-scan to verify fixes.
See package remediation and verification
These are application captures, not mockups. Overview, Findings and remediation use labeled sample data. The graph uses the reproducible reference lab: real parsers, a pinned advisory scan and authenticated gateway calls, with modeled infrastructure. A blocked call does not establish that the underlying package was fixed.
Discover and scan · Runtime policy and agent workflows · Run the reference evidence lab · Evidence workflow · Control-plane architecture
Self-host in your environment
Your infrastructure, your identity, your database, your audit boundary. Run the control plane on a workstation, a VM or your Kubernetes cluster. Connect the sources you need and add fleet collection or runtime enforcement as teams adopt them. The deployment guides cover credentials, persistence and access controls for each supported path.
For a workstation pilot, run from a published release checkout:
Open http://localhost:3000, then Connections or New Scan. For cloud accounts, add a scoped read-only connection, verify access, then start a scan. The pilot binds to loopback and retains state in a Docker volume. Use the authenticated deployment guide below for a shared instance.
| Where you run it | Start here |
|---|---|
| Workstation evaluation | Docker pilot — packaged API, dashboard and persistent state |
| Shared VM / private cloud | Authenticated deployment · Compose profile — PostgreSQL and configured identity |
| Kubernetes | Helm deployment · EKS Terraform |
| Snowflake | Native App installation |
| Restricted networks | Air-gapped image bundle |
Choose a deployment · Enterprise configuration · Connect cloud accounts
Work with your existing tools
Use the CLI or GitHub Action in CI, the REST API for automation, and MCP from coding assistants. Export SARIF, CycloneDX, SPDX, JSON and HTML for downstream workflows. Cloud connectors and fleet sync feed the control plane; proxy and gateway deployments contribute runtime evidence.
Integration capability matrix · MCP client setup · Proxy, gateway and fleet · Smithery setup and manifest
Quick start
Scan a repository:
Save CI evidence with agent-bom scan . -f sarif -o findings.sarif.
Use agent-bom doctor to check setup. First-run guide
Try the CLI demo: agent-bom scan --demo --offline.
The synthetic sample deliberately triggers a security gate (exit 1).
The recording runs the offline command and pages its output for readability.
Give assistants access to the same evidence:
Start with eight focused tools, then select a graph, cloud, runtime or audit profile. The full catalog has 86 MCP tools, 7 resources, and 8 workflow prompts. MCP workflows
Developer gates and offline scans
Use uvx agent-bom scan . without a global install, or
uvx agent-bom check requests@2.33.0 --ecosystem pypi before adding a package.
For automatic dependency and secret gates, see
pre-commit and CI setup.
agent-bom db update --osv-ecosystem PyPI covers only the selected ecosystem;
add the ecosystems you need before running agent-bom scan . --offline.
The full agent-bom db update --source osv archive can exceed 1 GB; the command shows live progress.
A non-zero exit can mean a security gate or incomplete assessment: inspect the
report and coverage. Exit codes
Trust and evidence
Discovery uses read-only access by default. Explicit disk side-scans create temporary cloud resources; runtime enforcement acts on selected tool calls. Missing evidence stays unavailable or partial. Control mappings are not audit certification.
Related MCP Servers
Adoption & maintenance
Factual signals from GitHub, npm, and our automated checks — not a rating.
GitHub stars
31
Stargazers on the source repository.
Last commit
2d ago
Most recent push to the default branch.
Directory activity
2 views
Config copies, upvotes, and views on AllMCPs.
Reviews
No reviews yet — be the first to share how this listing worked for you.
Frequently Asked Questions about Agent Bom
AllMCPs Directory Badge
Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.
Badge Style:
Live Dynamic SVG Preview
Markdown (GitHub README)
[](https://allmcps.com/mcp/msaad00-agent-bom)HTML Embed
<a href="https://allmcps.com/mcp/msaad00-agent-bom"><img src="https://allmcps.com/api/badge/msaad00-agent-bom?style=directory" alt="Agent Bom on AllMCPs" /></a>Technical Specs & Signals
CategorySecurity
PricingFree
11/11 checks healthy over the last 32d
56Quality signal: Good · 56/100How this signal is calculated ▾
Server availabilityNot measured
Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.
Verified ownership10/20
Documentation & tools25/30
Adoption & activity7/15
Community engagement0/10
A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.
Supply-chain signal
No high-severity advisories surfaced by our automated scan.
Critical 0High 0Medium 0Low 0
Scanned 22d ago via OSV.dev · agent-bom (PyPI)
Own this project?
This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge — proof is checked automatically, then reviewed by our team.
Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.
Claim & get free dofollowShare & Embed
Add our SVG badge (dark/light directory styles) or embeddable widget to your site.