For AppSec and platform engineers. Self-host free; local scans need no account.
Quick start
From the repository you want to inspect, with uv installed:
uvx agent-bom scan .
Measured on real repositories: 299 of 299 OSV advisories matched across seven
real repositories, no false positives.
Read the discovered agents and MCP servers, prioritize the highest-severity
findings, and follow the affected package's fix guidance. Review coverage gaps
beside the verdict: incomplete evidence is not a clean assessment.
What this scan does and does not establish.
No project handy? Run uvx agent-bom scan --demo --offline for a bundled sample.
Exit 1 is expected: the sample trips the security gate. A non-zero exit
can mean a security gate or incomplete assessment; inspect the report and coverage.
See the exit codes.
Apply a reviewed fix, update the lockfile, then rerun uvx agent-bom scan .
against the same repository to verify the finding changed.
Save a report with uvx agent-bom scan . -f sarif -o findings.sarif, then
upload it and gate CI.
Run uvx agent-bom doctor if setup fails. See the first-run guide
for pip installation, or ask your coding agent with the checkup skill.
In GitHub Actions, the same scan uploads SARIF to code scanning and fails on
high or critical findings, the same default gate as the CLI:
permissions:
contents: read
security-events: write
steps:
- uses: actions/checkout@v4
- uses: koda-ai-studio/agent-bom@v0
with:
upload-sarif: 'true'
The recording uses labeled sample data and bundled advisories. Credential
references are names, not secret values. Recorded relationships do not prove
exploitation or successful data access.
What it covers
| Area | What you get |
|---|
| SBOM, AI-BOM and Agent-BOM | Generate software SBOMs in CycloneDX or SPDX. For an AI-BOM, CycloneDX AI components carry collected model metadata. Native agent-bom JSON connects agents, MCP servers, tools, credential references and packages. |
| Dependencies | Lockfiles and manifests across Python, JavaScript, Go, Java, .NET, Rust and more, matched against OSV, GitHub advisories and NVD with KEV and EPSS. Ask "am I affected by CVE-X" across every stored scan. |
| Code | Findings from Semgrep or any SARIF tool, plus native analysis of AI code (prompt-injection sinks, guardrails, tool exposure) and whether your code reaches the vulnerable function. |
| Containers and IaC | Images scanned in bounded memory and time; Dockerfile, Terraform, Kubernetes, Helm and compose risks with exact lines in SARIF. |
| AI agents and MCP | Agents, MCP servers, tools and credentials from local configs and agent frameworks, linked to what they can reach. |
| Cloud and data platforms | Read-only collection from AWS, Azure, GCP, Kubernetes, Databricks and Snowflake, with provider-specific posture checks and graph context. See the coverage matrix for each collection lane. |
| GPU and AI infrastructure | Discover AI workloads on CoreWeave, Nebius, Lambda, RunPod, Vast.ai and Crusoe; inventory GPU containers and Kubernetes GPU nodes. Collection depth varies by provider. |
| Models and AI platforms | Discover supported OpenAI, Hugging Face, Ollama, MLflow and W&B assets and retain available model provenance alongside dependencies and agent context. |
| Runtime | An MCP proxy and gateway that alert on poisoned tools and injected results, or block them with --injection-mode enforce. |
Generate a BOM from a project, or inspect an agent inventory with sample data:
agent-bom scan --project . -f cyclonedx -o sbom.cdx.json
agent-bom scan --project . -f spdx -o sbom.spdx.json
agent-bom scan --demo --offline -f json -o agent-bom.json
Open the artifact to inspect the collected components and relationships. Model
metadata appears when the selected source supplies it; a BOM is an inventory,
not proof of safe execution or complete collection.
Discovery and scanning read from these sources; the last row lists evidence destinations.
| Area | Integrations |
|---|
| AI clients + IDEs | Claude, Codex, Cursor, GitHub Copilot, Windsurf, Cortex Code, Gemini CLI, JetBrains AI, Junie, Amazon Q, Cline, Roo Code, Continue, Zed, Goose, Snowflake CLI, Docker MCP Toolkit, Tabnine, Sourcegraph Cody, Aider, Void, Aide, Trae, Pieces, OpenClaw, mcp-cli |
| AI platforms + model hubs | OpenAI, Hugging Face, Ollama, MLflow, W&B, Langfuse, LangSmith |
| GPU + neo clouds | CoreWeave, Nebius, Lambda, RunPod, Vast.ai, Crusoe, GPU containers + K8s GPU nodes |
| Hyperscalers + Kubernetes | AWS, Azure, GCP, Kubernetes |
| Data + vector stores | Snowflake, Databricks, Supabase, Pinecone, Qdrant, Weaviate, Chroma, Milvus |
| Identity + SaaS + dev | Okta, GitHub Actions, Vercel, Microsoft Entra ID, Jira, ServiceNow, Slack, Jamf |
| Evidence out | ClickHouse, BigQuery, S3, GCS, Azure Blob, Jira tickets, Slack alerts, Vanta, Drata, OCSF syslog |
Product names and logos are trademarks of their owners, used only to identify supported evidence sources. Their use does not imply endorsement or partnership.
Investigate context and exposure
Which agent uses the vulnerable component? What could it reach? What evidence supports that path?
Correlate retained scans by exact, tenant-scoped identities; trace the recorded
blast radius from each agent through its MCP servers to packages, findings,
credentials and data stores. Inspect each relationship's source and evidence
kind, then rescan the same scope to check what changed.
Fictional sample estate. Dashed use, credential and access links are configured
or modeled, not observed at runtime; path analysis covers the collected snapshot only.
Open the full-size environment graph.
From agent to verified fix: select Document Intake Agent → inspect
CVE-2023-4863 (high, KEV-listed) and the evidence on each arrow → take the
proposed remediation →
rescan the changed pin and compare snapshots.
The comparison verifies the changed input, not a running deployment.
Supporting evidence: one package, three parsed inputs. A repository pin, an
image SBOM and a modeled Kubernetes workload resolve to one [email protected]. The
image inventory and the deployment occurrence stay separate nodes; the advisory
receipt is open.
Real parsers, modeled infrastructure; a graph path does not prove exploitation.
Open the full-size relationship graph.
Explore context, correlation and reachability · Run the reference lab · Reproduce these screenshots
Explain a finding to your team: create an impact brief
with affected assets, source receipts, evidence gaps and the next action to review.
Am I affected by a new CVE? Match it against stored scans, including CVEs only
NVD has published, and get affected assets with their patch target, possibly
affected distro packages to verify, and the blast radius
(walkthrough):
agent-bom db update # refresh OSV, NVD, KEV and EPSS
agent-bom db advisory affected CVE-2026-109618 # most recent saved scan
agent-bom db advisory affected CVE-2026-109618 --report <scan-report.json> --format json # a JSON report written by an earlier scan
From an MCP client, the read-only affected_assets tool (graph and full
profiles) takes the same advisory_id. In CI, run uvx agent-bom db update
before the GitHub Action step above (its auto-update-db default only
refreshes feeds older than seven days); the rescan then fails on the new
advisory at the configured severity.
Trace source imports, deployment configuration and CI to a published container
and its vulnerable packages:
Follow a public API gateway into a vulnerable workload, its role and a PII bucket:
Open the sample graph
Try the demo in your browser: a read-only copy of the UI on
labelled sample data, with no install and no backend. Scans, settings and
sign-in are turned off there. To open the same graph locally:
pip install 'agent-bom[ui]==0.111.0'
agent-bom quickstart --run --offline
Run the server command it prints, then open its graph URL. Offline quickstart
skips package-CVE lookup, so zero CVEs is not a clean verdict; use the bundled
demo for advisory-backed findings or populate the advisory database.
Self-host in your environment
Your infrastructure, identity, database, and audit boundary. Start a local
pilot from a published release checkout:
git clone --depth 1 --branch v0.111.0 https://github.com/koda-ai-studio/agent-bom.git && cd agent-bom
AGENT_BOM_IMAGE_TAG=0.111.0 docker compose up -d
Open http://localhost:3000, then Connections or New Scan. The pilot
binds to loopback and retains state in a Docker volume. For cloud accounts, add a
scoped read-only connection, verify access, then start a scan. Use the
authenticated deployment.
- Scan with CLI or CI; export findings, SBOMs and reports.
- Centralize inventory, graph evidence, remediation and compliance in your own control plane.
- Enforce policy on selected live MCP tool calls through the proxy or gateway.
Deployment types and operating modes
Choose where to run the product, then enable the collection or runtime modes
needed for your environment.
| Deployment | First step | Result and next step |
|---|
| CLI or CI job | agent-bom scan --demo --offline -o report.json | Labelled sample findings in JSON; scan your own inventory or configure a CI gate. |
| Local API and dashboard | agent-bom quickstart --run --offline | Sample report and persisted graph; run the printed loopback server command and open its graph URL. |
| Docker Compose pilot | Release checkout and docker compose up -d above | Loopback API/UI with retained state; connect a read-only source and run a scan. |
| Authenticated single host | Platform Compose setup | Login-gated API/UI and PostgreSQL; configure TLS, identity, secrets and backups before sharing access. |
| Kubernetes / EKS | Helm deployment | Control plane in your cluster; provision role-separated secrets and storage, then validate authentication and health. |
Operating modes can be combined:
- Scan: collect inventory and findings on demand or in CI; retain reports and graph evidence.
- Fleet inventory: endpoints or collectors sync inventory to the control plane. Start with the fleet sync command, then review endpoint inventory and last-seen evidence.
- MCP server:
agent-bom mcp server exposes security tools to an MCP client. Configure the client and tool profile, then query scan evidence.
- Runtime proxy: wrap selected local stdio MCP servers to inspect tool calls. Follow the proxy setup and verify policy decisions in the audit trail.
- Runtime gateway: relay selected remote MCP traffic through a shared service. Follow the gateway setup and validate client authentication, policy and upstream connectivity.
The dashboard's Sources indicator describes recorded evidence: local scans,
fleet inventory, cluster scans, CI/CD, imported evidence, or mixed sources. It
does not select a deployment type or enable runtime enforcement. Demo data
identifies labelled sample inventory. Preview and community deployment paths
have separate support boundaries.
In the console, Assets are inventoried resources, Findings are detections
on those resources, and Issues group related findings for investigation or
remediation. Affected assets counts distinct resources only when that count
is available. One finding may belong to several security areas, so area counts
must not be summed. Repeated observations across scans are shown separately.
Docker pilot guide · Compose with PostgreSQL · Choose a deployment · Enterprise controls · Connect cloud accounts
Use CLI or GitHub Action, REST API, or MCP; export SARIF, CycloneDX,
SPDX, JSON and HTML. Cloud connectors and fleet sync collect inventory;
proxy and gateway deployments add runtime evidence.
For other MCP clients, run agent-bom mcp server.
Start with eight focused tools in the default profile.
Choose an MCP profile for graph, cloud, runtime or audit work.
Try three investigations: affected agents, exposure receipts and a before/after scan comparison.
Import existing scanner reports without replacing their source evidence.
Check a dependency before installing it with
uvx agent-bom check [email protected] --ecosystem pypi. Add
pre-commit and CI setup for repeated checks.
Proxy, gateway and fleet · Integration capability matrix · MCP client setup · Smithery setup and manifest
Integrations
Ask your coding agent instead of reading a report. In Claude Code:
/plugin marketplace add koda-ai-studio/agent-bom
/plugin install agent-bom@agent-bom
In Codex, run codex plugin marketplace add koda-ai-studio/agent-bom, then
install agent-bom-local from the Plugins Directory. Both plugins run the
pinned agent-bom release locally and send nothing to an agent-bom service.
| Ask | Skill |
|---|
| "Is this project safe to ship?" | checkup: one verdict and the three fixes that matter most |
| "Am I affected by CVE-2025-29927?" | affected: affected or not found in what was scanned, never "safe" |
| "What have my agents been doing?" | activity: MCP usage, unused servers, risky commands from local session history |
| "Are my agent settings too permissive?" | audit-mcp and audit-skills |
| "Give me an AI-BOM" | bom: CycloneDX or SPDX for this machine, a project, an image or a cloud account |
Add /plugin install agent-bom-guard@agent-bom to block malicious and
typosquatted package installs before Claude runs them.
All skills and their permissions ·
Guard details
Trust and evidence
Discovery uses read-only access by default. Explicit disk side-scans create
temporary cloud resources. Missing evidence stays unavailable or partial;
control mappings are not audit certification.
Persisted runtime, proxy and gateway activity retains source receipts and
bounded time windows in the graph. Exact inventory references can bind records;
unresolved identities and collection gaps remain explicit. Recorded activity
does not prove execution or grant access. See the runtime evidence boundaries.
MITRE technique associations provide investigation context, not proof of an
attack. ATLAS mapping receipts retain the weakness
association and source catalog hashes; modeled graph paths do not establish
observed execution or effective access.
Measured matcher proof · Product boundaries · Permissions · Threat model · Release verification · Graph data model
Contributing and support
Start with the first PR guide
or a good first issue.
Ask in GitHub Discussions (or Discord), share feedback,
or follow the maintainer path (review owners).
Contributing · Capabilities and roadmap · Support · Report an inaccurate finding · Apache-2.0
Source version: v0.112.1 · Latest release: v0.111.0 · Changelog
