Agent Bom
AI supply chain security scanner — 7 tools for CVE scanning, blast radius mapping, SBOM generation, compliance posture (OWASP/ATLAS/NIST), policy enforcement…
Community: Submitted by a user or imported; check the owner before granting accessOnlineNo sign-inGlobalFreeCan modify data
What it can do
- Scan: Run a full AI supply chain security scan and return an AI-BOM. Point it at a target with one of: • repo_url — a public git repo URL (cloned + scanned, no checkout) • config_path — a local projec
- Check: Check a specific package for known CVEs before installing. Queries OSV.dev for vulnerabilities in the given package. Use this before installing an MCP server or dependency to verify it is safe.
- Intel Lookup: Look up one advisory from the local threat-intel database.
What data it sees
Do you need an account
No: the server works without sign-in
AI supply chain security scanner — 7 tools for CVE scanning, blast radius mapping, SBOM generation, compliance posture (OWASP/ATLAS/NIST), policy enforcement, and remediation planning for AI agents and MCP servers. Read-only, no credentials accessed.
Server tool list (60)
Raw names from tools/list. Only developers need these.
| scan | Run a full AI supply chain security scan and return an AI-BOM. Point it at a target with one of: • repo_url — a public git repo URL (cloned + scanned, no checkout) • config_path — a local project / MCP-config directory • image — a Docker image • sbom_path — an existing CycloneDX/SPDX SBOM • package — a single package or MCP launch command (pair it with ``ecosystem`` when the spec names no launcher) With none of these, it auto-discovers local MCP clients (Claude Desktop, Cursor, Windsurf, VS Code Copilot, OpenClaw, etc.). It extracts package dependencies, queries OSV.dev for CVEs, assesses config security (credential exposure, tool access), computes blast radius, and returns structured results. Scanning is fully static and read-only — repository and image contents are parsed, never executed. Returns: JSON with the complete AI-BOM report including agents, packages, vulnerabilities, blast radius, and remediation guidance. |
| check | Check a specific package for known CVEs before installing. Queries OSV.dev for vulnerabilities in the given package. Use this before installing an MCP server or dependency to verify it is safe. Args: package: Package name with optional version, e.g. "express@4.18.2", "@modelcontextprotocol/server-filesystem@2025.1.14", or just "requests" (resolves @latest). ecosystem: Package ecosystem — "npm", "pypi", "go", "cargo", "maven", "nuget", "rubygems", "composer", "swift", "pub", "hex", "conda", "deb", "apk", or "rpm". Defaults to "npm". Returns: JSON with package, version, ecosystem, vulnerability count, and vulnerability details (id, severity, cvss, fix version, summary). |
| intel_lookup | Look up one advisory from the local threat-intel database. |
| intel_match | Match package inventory coordinates to local threat-intel advisories. |
| intel_sources | Return canonical threat-intel sources and local feed-run freshness. |
| intel_daily_brief | Return a local analyst threat brief from governed intel sources. |
| youcom_search | Search You.com for current web or news context. |
| blast_radius | Look up the blast radius of a specific CVE across your AI agent setup. Reads the tenant's persisted control-plane finding evidence when it is available. Standalone MCP mode falls back to a local MCP configuration scan and labels that narrower source explicitly. Args: cve_id: The CVE identifier (e.g. "CVE-2024-1234" or "GHSA-xxxx"). Returns: JSON with blast radius details including risk_score, affected_servers, affected_agents, exposed_credentials, and exposed_tools. Returns found=false if CVE not found. |
| exposure_paths | Return ranked ExposurePath JSON for headless security agents. This is the agent-native graph surface: Claude, Cursor, Codex, Windsurf, Cortex, and other MCP clients can request the same investigation objects used by the dashboard without scraping UI state. |
| should_i_deploy | Return an allow / warn / block deploy decision from graph exposure risk. Resolves a deployment candidate against the latest security-graph snapshot, ranks its reachable ExposurePaths by risk score, and maps the top score to a gate decision using the warn/block thresholds. Args: candidate: Package, resource, CVE, graph node ID, or deployment label to evaluate. tenant_id: Tenant whose graph snapshot to read (default ``default``). scan_id: Specific graph scan ID; omit to use the latest snapshot. limit: Maximum matched exposure paths to return (1-25). warn_risk: Risk score at or above which the decision becomes warn. block_risk: Risk score at or above which the decision becomes block. Returns: JSON with the ``decision`` (allow/warn/block), the driving risk score, and the ranked exposure paths behind it. Call this as a pre-deployment gate to get a single machine-readable verdict instead of interpreting raw findings. |
| policy_check | Evaluate a security policy against current scan results. Runs a scan, then evaluates the provided policy rules against the findings. Policies can gate on severity thresholds, CISA KEV status, AI risk flags, credential exposure, and denied packages. Args: policy_json: JSON string containing policy rules. Example: {"rules": [{"id": "no-critical", "severity_gte": "critical", "action": "fail"}, {"id": "no-kev", "kev": true, "action": "fail"}]} Returns: JSON with passed (bool), violations list, failure_count, and warning_count. |
| registry_lookup | Query the agent-bom MCP server threat intelligence registry. Look up risk level, known tools, credential requirements, and verification status for known MCP servers. The registry contains 109+ servers with security metadata. Args: server_name: MCP server name to look up (e.g. "filesystem", "@modelcontextprotocol/server-github"). package_name: Package name to search for (e.g. "mcp-server-sqlite"). At least one of server_name or package_name is required. Returns: JSON with registry entry: risk_level, verified, tools, credential_env_vars, risk_justification. Returns found=false if not found. |
| generate_sbom | Generate a Software Bill of Materials (SBOM) for your AI agent setup. Discovers AI agents and MCP servers, extracts all package dependencies, and generates a standards-compliant SBOM. Args: format: SBOM format — "cyclonedx" (CycloneDX 1.7) or "spdx" (SPDX 3.0). config_path: Path to a specific MCP config directory. If not provided, auto-discovers all local agent configs. Returns: JSON string containing the SBOM in the requested format. |
| compliance | Get OWASP LLM Top 10 / OWASP MCP Top 10 / MITRE ATLAS / NIST AI RMF compliance posture. Scans local MCP configurations, maps findings to 47 security controls across four AI security frameworks, and returns per-control pass/warning/fail status with an overall compliance score. Args: config_path: Path to a specific MCP config directory. If not provided, auto-discovers all local agent configs. image: Docker image reference to scan (e.g. "nginx:1.25"). Returns: JSON with overall_score (0-100), overall_status (pass/warning/fail/no_data), and per-control details for OWASP LLM Top 10 (10 controls), OWASP MCP Top 10 (10 controls), MITRE ATLAS (13 techniques), and NIST AI RMF (14 subcategories). Plus a nist_800_53_catalog line: the vendor-asserted, catalog-backed NIST SP 800-53 Rev 5 score over evaluated controls only (with ISO-27001-by-id attribution), scored independently and NOT folded into overall_score. |
| remediate | Generate a remediation plan for vulnerabilities in your AI agent setup. Scans for vulnerabilities, then generates actionable fix commands for each affected package (npm install, pip install), credential scope reduction guidance, and reports on unfixable vulnerabilities. Args: config_path: Path to a specific MCP config directory. If not provided, auto-discovers all local agent configs. image: Docker image reference to scan (e.g. "nginx:1.25"). Returns: JSON with package_fixes (upgrade commands by ecosystem), credential_fixes (scope reduction steps), and unfixable items. |
| verify | Verify package integrity and SLSA provenance against registries. Checks SHA-256/SRI hashes against npm/PyPI registries and looks up SLSA build provenance attestations to confirm the package was built from its claimed source repository. Returns: JSON with integrity verification (hash match, expected vs actual) and provenance status (SLSA level, source repo, build trigger). |
| inventory_summary | Return unified asset-inventory counts by type and source group. Counts every non-finding asset in the tenant's current graph snapshot — AI (agents, MCP servers, models, tools, credentials), cloud (resources, data stores, accounts), Snowflake, and identity — bucketed by OCSF entity type and by operator-facing group (ai / cloud / identity / secrets / code). Findings (CVEs, misconfigurations) are excluded; use blast_radius or exposure_paths for the finding queue. |
| inventory_list | Return a filtered, paginated page of inventory asset rows. ``type`` / ``search`` / ``min_severity`` are pushed into the graph store; the ``environment`` / ``provider`` / ``source`` facets are matched with a bounded keyset refill loop so a filtered page is never silently truncated. Page deep with the returned ``pagination.next_cursor``. Findings never appear in the list. |
| inventory_asset | Return one asset's attributes, relationships, and blast-radius impact. Reuses the graph store's node context so an agent gets the same config, inbound/outbound edges, neighbors, sources, and impact the dashboard drawer renders. Returns a clean not-found error when the asset id is not present in the tenant's snapshot. |
| skill_scan | Scan skill and instruction files for trust, findings, and provenance. |
| skill_verify | Verify Sigstore provenance for skill and instruction files. |
| skill_trust | Assess the trust level of a SKILL.md file using ClawHub-style categories. |
| where | Show all MCP discovery paths and which config files exist. |
| inventory | List all discovered MCP configurations and servers without CVE scanning. |
| tool_risk_assessment | Live-introspect MCP servers and score each tool's capability risk. Discovers configured MCP clients, connects to their servers, calls ``tools/list``, and classifies every exposed tool by capability (filesystem, network, code execution, credential access) to produce a per-tool and per-server risk score from what the servers actually advertise at runtime. Args: config_path: MCP client config directory to read; auto-discovers all supported clients when omitted. timeout: Per-server introspection timeout in seconds. Returns: JSON with per-server tool inventories, per-tool capability classes and risk levels, and an aggregate server risk rating. Use this to assess the blast radius of MCP servers an agent can reach before granting or trusting their tools. |
| create_ticket | File an ITSM ticket for a finding through a stored connection. Connect-once: auth and the ITSM base URL come only from the stored, encrypted connection — no credential or link is passed here. Requires an admin operator + ``ticketing:write`` scope. Idempotent per finding. |
| sync_ticket_status | Refresh a filed ticket's status from its ITSM through the connection. Requires an admin operator + ``ticketing:write`` scope. Resolves auth and endpoint from the stored connection only. |
| diff | Compare a fresh scan against a baseline to find new and resolved vulns. Runs a new scan, then diffs it against the provided baseline (or the latest saved report). Shows new vulnerabilities, resolved ones, and changes in the package inventory. Not read-only: this persists the fresh scan to report history and may prune older saved reports, so it is annotated as a (destructive) write. Returns: JSON with new findings, resolved findings, new/removed packages, and a human-readable summary. |
| findings_triage | Record a tenant-scoped finding triage decision to the exception store. Writes the same entry as the REST ``POST /v1/findings/triage`` endpoint. Requires an admin operator + ``findings:write`` scope. A ``not_affected`` decision requires an OpenVEX ``justification``. |
| list_exceptions | List tenant-scoped exception evidence from the canonical store. |
| request_exception | Create a pending exception through the shared REST/UI/MCP lifecycle. |
| approve_exception | Activate a pending exception through the canonical lifecycle store. |
| risk_campaign_workflow | List, assign, ticket, or verify a tenant-scoped remediation campaign. Uses the same campaign store and verification service as REST and CLI. Writes require an authenticated admin operator with ``findings:write``. |
| cloud_side_scan | Trigger one agentless Azure/GCP disk side-scan and read back honest state. Runs the same executor as ``agent-bom cloud side-scan`` and the REST ``POST /v1/cloud/side-scan``: snapshot the disk, mount a temp copy on an in-account collector read-only, record SBOM + CVE + secret *metadata* only, and tear every owned temporary resource down. Requires an admin operator + ``cloud:write`` scope. Credentials are never accepted here — the executor resolves read-only credentials from the provider's default chain (``credentialed_smoke=false``). Fail-closed and honest: OFF → ``disabled``; missing extra/credentials → ``unavailable``; never a clean-workload claim. |
| marketplace_check | Pre-install trust check for an MCP server package. Queries the package registry (npm or PyPI) for metadata and cross-references against the agent-bom MCP threat intelligence registry. Returns trust signals including download count, CVE status, and registry verification. Args: package: Package name to check. ecosystem: 'npm' or 'pypi'. Defaults to 'npm'. Returns: JSON with name, version, ecosystem, cve_count, download_count, registry_verified, and trust_signals. |
| code_scan | Run SAST (Static Application Security Testing) on source code via Semgrep. Scans for security flaws: SQL injection, XSS, command injection, hardcoded credentials, insecure deserialization, path traversal, etc. Returns findings with CWE classifications and severity levels plus a typed ``findings``, ``clean``, ``skipped``, or ``failed`` status. Requires ``semgrep`` on PATH (``pip install semgrep``). |
| context_graph | Build an agent context graph with lateral movement analysis. Models reachability between agents, servers, credentials, tools, and vulnerabilities. Answers: "If agent X is compromised, what else becomes reachable?" Returns: JSON with nodes, edges, lateral_paths, interaction_risks, and stats. |
| graph_export | Export the agent dependency graph in graph-native formats. Formats: - **graphml** — yEd, Gephi, NetworkX compatible with AIBOM-typed attributes - **cypher** — Neo4j import script with AIBOM node labels (AIAgent, MCPServer, Package, Vulnerability) - **dot** — Graphviz (pipe through ``dot -Tsvg``) - **mermaid** — embed in markdown, GitHub, Notion - **json** — machine-readable nodes/edges list Returns: Graph in the requested format as a string. |
| analytics_query | Query vulnerability trends, posture history, and runtime event summaries from ClickHouse. Requires AGENT_BOM_CLICKHOUSE_URL to be set. Returns empty results if ClickHouse is not configured. |
| cis_benchmark | Run CIS benchmark checks against a cloud account. Evaluates security posture against CIS Foundations Benchmarks: - AWS Foundations v3.0: 18 checks (IAM, Storage, Logging, Networking) - Snowflake v1.0: 12 checks (Auth, Network, Data Protection, Monitoring, Access Control) - Azure Security Benchmark v3.0: 10 checks (IAM, Storage, Logging, Networking, Key Vault) - GCP Foundation v3.0: 8 checks (IAM, Logging, Networking, Storage) All checks are read-only. Failed checks include MITRE ATT&CK Enterprise technique mappings. Requires appropriate credentials for the chosen provider. Returns: JSON with per-check pass/fail results, evidence, severity, ATT&CK techniques, and pass rate. |
| kspm_cluster_posture | Evaluate live Kubernetes cluster security posture (KSPM). Read-only inspection of running workloads, RBAC, NetworkPolicy coverage, and (opt-in) kubelet config against the pinned CIS Kubernetes Benchmark. Distinct from image discovery: this returns SECURITY POSTURE, not a container-image inventory. Every collector carries an explicit execution state — executed / skipped / unevaluable (a denied or absent read) / failed — so a partial run is reported 'partial' with a coverage-affecting ScanRun issue and can never be laundered into a clean pass. The benchmark provenance, collector states, ScanRun outcome, and finding summary reconcile 1:1 with the REST /v1/kspm/clusters/posture route and the CLI evidence dict. Returns: JSON with benchmark provenance, per-collector states, the canonical ScanRun outcome, a finding count, and a per-severity summary. |
| fleet_scan | Batch-scan a list of MCP server names against the security metadata registry. Designed for fleet inventory data (EDR, SIEM, CSV exports) where you have server names but not versions. Returns per-server risk assessment with registry match status, risk category, tools, credentials, known CVEs, and a verdict (known-high-risk, known-medium, known-low, unknown-unvetted). Risk levels are category-derived (filesystem=high, database=medium, search=low), not made-up threat scores. Every field is traceable to a source. Returns: JSON with summary (total, matched, unmatched, risk breakdown) and per-server details. |
| runtime_correlate | Cross-reference vulnerability scan results with proxy runtime audit logs. Identifies which vulnerable tools were ACTUALLY CALLED in production, distinguishing confirmed attack surface from theoretical risk. Produces risk-amplified findings: a vulnerable tool that was called 100 times is higher priority than one never invoked. Also accepts an OTel trace file (``otel_trace``) to extract ML API call provenance: which models were called, token usage, and deprecation advisories. Requires a proxy audit log (generated by running agent-bom proxy with the --log flag). Without an audit log, returns scan results only. Returns: JSON with correlated findings (CVE + tool call data + amplified risk), summary stats, uncalled vulnerable tools, and ml_api_calls provenance. |
| runtime_production_index | Return metadata-only runtime production posture for agent/tool traffic. Summarizes tool-call volume, block rate, policy decisions, authorization trace posture, alerts, active sources/sessions, freshness, and retention mode without returning prompts, raw arguments, responses, or credential values. |
| runtime_blueprints | Return canonical role/profile blueprints for runtime policy design. |
| runtime_blueprint_drift | Compare current runtime traffic with an approved role/profile blueprint. |
| cost_report | Return LLM spend attribution (per agent/model/provider) and budget posture. Spend is derived from token counts on ingested OpenTelemetry GenAI spans priced via agent-bom's open cost model; no prompts or responses are read. |
| anomaly_scan | Surface cost and behavior anomalies: per-agent spend and per-session tool-call-rate statistical outliers, for proactive runaway-agent detection. |
| drift_incidents | List open blueprint-drift incidents (observed runtime traffic outside the approved role blueprint). Each incident records the blueprint, drift score, and top violations so an operator can reconcile the agent or blueprint and resolve it. |
| proxy_status | Return current MCP proxy metrics and alert summary, if a session is active. |
| proxy_alerts | Return recent runtime proxy alerts without prompts, arguments, or responses. |
| gateway_status | Return gateway policy, firewall, durable activity, and optional self-posture evidence. |
| shield_status | Return current Shield assessment for a session without changing enforcement state. |
| shield_start | Start Shield enforcement for a session. Requires admin role, shield:write scope, and audit reason. |
| shield_unblock | Unblock Shield enforcement for a session. Requires admin role, shield:write scope, and audit reason. |
| shield_break_glass | Run Shield break-glass override. Requires admin role, shield:write scope, and audit reason. |
| identity_issue | Issue a managed agent identity. Requires admin role, identity:write scope, and an audit reason. Returns the raw token once. |
| identity_rotate | Rotate a managed identity, keeping the old token live during the overlap window. Requires admin role, identity:write scope, and an audit reason. |
| identity_revoke | Revoke a managed identity immediately. Requires admin role, identity:write scope, and an audit reason. |
| identity_grant_jit | Grant an identity time-bound JIT access to one tool. Requires admin role, identity:write scope, and an audit reason. |