agent-bom

[agent-bom — Discover. Scan. Correlate. Act. Security evidence across repositories, software supply chains, AI and MCP, cloud, identity, and data.]

[Build] [PyPI] [Python 3.11 through 3.14]

[Apache-2.0 license] [OpenSSF Scorecard]

AI supply-chain BOM: every agent, MCP server and AI package, and what each one can reach.

For AppSec and platform engineers. Self-host free; local scans need no account.

Quick start · All integrations · Sample graph · Self-host · Product tour · Docs

Quick start

From the repository you want to inspect, with uv installed:

uvx agent-bom scan . --no-discover -f html -o agent-bom-report.html

Measured on real repositories: 299 of 299 OSV advisories matched across seven real repositories, no false positives.

Open agent-bom-report.html to review inventory, findings, coverage and fix guidance. This command scans the selected project, including its recorded MCP configuration; --no-discover excludes workstation-wide discovery.

No MCP configuration in the project? Package findings still apply. Agent/tool relationships require discovered configuration or an explicit inventory; their absence is a coverage limit. Review gaps beside the verdict: incomplete evidence is not a clean assessment. What this scan does and does not establish.

No project handy? Run uvx agent-bom scan --demo --offline for a bundled sample. Exit 1 is expected: the sample trips the security gate. A non-zero exit can mean a security gate or incomplete assessment; inspect the report and coverage. See the exit codes.

permissions:  contents: read  security-events: writesteps:  - uses: actions/checkout@v4  - uses: koda-ai-studio/agent-bom@v0    with:      upload-sarif: 'true'

[Recorded agent-bom CLI showing sample findings and remediation guidance; no fix executed]

The recording uses labeled sample data and bundled advisories. Credential references are names, not secret values. Recorded relationships do not prove exploitation or successful data access.

What it covers

Generate a BOM from a project, or inspect an agent inventory with sample data:

agent-bom scan --project . -f cyclonedx -o sbom.cdx.jsonagent-bom scan --project . -f spdx -o sbom.spdx.jsonagent-bom scan --demo --offline -f json -o agent-bom.json

Open the artifact to inspect the collected components and relationships. Model metadata appears when the selected source supplies it; a BOM is an inventory, not proof of safe execution or complete collection.

Investigate context and exposure

Which agent uses the vulnerable component? What could it reach? What evidence supports that path? Correlate retained scans by exact, tenant-scoped identities; trace the recorded blast radius from each agent through its MCP servers to packages, findings, credentials and data stores. Inspect each relationship's source and evidence kind, then rescan the same scope to check what changed. Agent kind, platform association, execution host and model links are separate facts; an environment badge does not establish where an agent runs or which model endpoint it calls.

[Sample production AI environment: Document Intake Agent uses a document-tools MCP server that depends on pillow 9.0.0, linked to KEV-listed CVE-2023-4863; Support Triage Agent uses a ticketing MCP server that references TICKETING_API_KEY, which can access a customer ticket archive]

Fictional sample estate. Dashed use, credential and access links are configured or modeled, not observed at runtime; path analysis covers the collected snapshot only. The AWS badge describes environment membership. These generic sample agents have no recorded execution host or model endpoint. Open the full-size environment graph. Read agent, hosting and model context.

From agent to verified fix: select Document Intake Agent → inspect CVE-2023-4863 (high, KEV-listed) and the evidence on each arrow → take the proposed remediation → rescan the changed pin and compare snapshots. The comparison verifies the changed input, not a running deployment.

Explain a finding to your team: create an impact brief with affected assets, source receipts, evidence gaps and the next action to review.

Am I affected by a new CVE? Match it against stored scans, including CVEs only NVD has published, and get affected assets with their patch target, possibly affected distro packages to verify, and the blast radius (walkthrough):

agent-bom db update                                   # refresh OSV, NVD, KEV and EPSSagent-bom db advisory affected CVE-2026-109618        # most recent saved scanagent-bom db advisory affected CVE-2026-109618 --report <scan-report.json> --format json   # a JSON report written by an earlier scan

From an MCP client, the read-only affected_assets tool (graph and full profiles) takes the same advisory_id. In CI, run uvx agent-bom db update before the GitHub Action step above (its auto-update-db default only refreshes feeds older than seven days); the rescan then fails on the new advisory at the configured severity.

Open the sample graph

Try the demo in your browser: a read-only copy of the UI on labelled sample data, with no install and no backend. Scans, settings and sign-in are turned off there. To open the same graph locally:

pip install 'agent-bom[ui]==0.112.1'agent-bom quickstart --run --offline

Run the server command it prints, then open its graph URL. Offline quickstart skips package-CVE lookup, so zero CVEs is not a clean verdict; use the bundled demo for advisory-backed findings or populate the advisory database.

Self-host in your environment

Your infrastructure, identity, database, and audit boundary. Start a local pilot from a published release checkout:

git clone --depth 1 --branch v0.112.1 https://github.com/koda-ai-studio/agent-bom.git && cd agent-bomAGENT_BOM_IMAGE_TAG=0.112.1 docker compose up -d

Open http://localhost:3000, then Connections or New Scan. The pilot binds to loopback and retains state in a Docker volume. For cloud accounts, add a scoped read-only connection, verify access, then start a scan. Use the authenticated deployment.

• Scan with CLI or CI; export findings, SBOMs and reports.
• Centralize inventory, graph evidence, remediation and compliance in your own control plane.
• Enforce policy on selected live MCP tool calls through the proxy or gateway.

Deployment types and operating modes

Choose where to run the product, then enable the collection or runtime modes needed for your environment.

Operating modes can be combined:

• Scan: collect inventory and findings on demand or in CI; retain reports and graph evidence.
• Fleet inventory: endpoints or collectors sync inventory to the control plane. Start with the fleet sync command, then review endpoint inventory and last-seen evidence.
• MCP server: agent-bom mcp server exposes security tools to an MCP client. Configure the client and tool profile, then query scan evidence.
• Runtime proxy: wrap selected local stdio MCP servers to inspect tool calls. Follow the proxy setup and verify policy decisions in the audit trail.
• Runtime gateway: relay selected remote MCP traffic through a shared service. Follow the gateway setup and validate client authentication, policy and upstream connectivity.

The dashboard's Sources indicator describes recorded evidence: local scans, fleet inventory, cluster scans, CI/CD, imported evidence, or mixed sources. It does not select a deployment type or enable runtime enforcement. Demo data identifies labelled sample inventory. Preview and community deployment paths have separate support boundaries.

In the console, Assets are inventoried resources, Findings are detections on those resources, and Issues group related findings for investigation or remediation. Affected assets counts distinct resources only when that count is available. One finding may belong to several security areas, so area counts must not be summed. Repeated observations across scans are shown separately.

Docker pilot guide · Compose with PostgreSQL · Choose a deployment · Enterprise controls · Connect cloud accounts

Integrations

/plugin marketplace add koda-ai-studio/agent-bom/plugin install agent-bom@agent-bom

Trust and evidence

Discovery uses read-only access by default. Explicit disk side-scans create temporary cloud resources. Missing evidence stays unavailable or partial; control mappings are not audit certification.

Measured matcher proof · Product boundaries · Permissions · Threat model · Release verification · Graph data model

Contributing and support

[Open in GitHub Codespaces]

Start with the first PR guide or a good first issue. Ask in GitHub Discussions (or Discord), share feedback, or follow the maintainer path (review owners).

Contributing · Capabilities and roadmap · Support · Report an inaccurate finding · Apache-2.0

Source version: v0.112.1 · Latest release: v0.112.1 · Changelog