agent-bom

For security, AppSec and GRC teams: discover AI agents, MCP servers, packages, credential references and infrastructure across repositories, container images, Kubernetes and cloud accounts. Check vulnerabilities and configuration, import existing scanner findings, and investigate the recorded relationships behind each finding.

• Scan from the CLI or CI and export findings, SBOMs and reports.
• Centralize inventory, graph evidence, remediation and compliance in your own control plane.
• Enforce policy on live MCP tool calls through the proxy or gateway.

Quick start

pip install agent-bom
agent-bom scan .

The scan prints project inventory, package findings and remediation guidance. Run agent-bom doctor to check setup, or follow the first-run guide. No project handy? Run agent-bom scan --demo --offline for a bundled sample without network access. Exit 1 is expected: the sample trips the security gate.

For CI, save a report with agent-bom scan . -f sarif -o findings.sarif, then upload it and gate the build. A non-zero exit can mean a security gate or incomplete assessment; inspect the report and exit codes.

agent-bom scan --demo --offline

The sample lists agents, CVEs and policy findings (excerpt from current source; installed-release output may differ):

  Security posture:   CRIT  7   HIGH  10   MED   6 · all finding categories
  5 agents · 10 servers · 23 packages
DISCOVER | Agents
  Agent                Type              Servers    Pkgs    Creds    Vulns
  langchain-service    custom                  2       4        4        4
  claude-desktop       claude-desktop          2       6        3        5
ANALYZE | Critical Details
  CVE-2023-36258 · langchain@0.0.150 · CRITICAL
  Fix: upgrade to ≥ 0.0.247
  Blast: langchain-service → llm-orchestrator-server → ANTHROPIC_API_KEY, OPENAI_API_KEY
ANALYZE | Graph & Policy Findings (8 occurrences)
   CRIT  COMBINATION AI agent can reach a credential or privileged tool: langchain-service
   HIGH  PROMPT_SECURITY Agent calls MCP server without verified identity
   MED   PROMPT_SECURITY Long-lived static credential on MCP server

For sample inventory with an exact graph link, run agent-bom quickstart --run --offline (it skips package-CVE lookup). First-run guide

Use uvx agent-bom scan . without a global install, or uvx agent-bom check requests@2.33.0 --ecosystem pypi before adding a package. For automatic dependency and secret gates, see pre-commit and CI setup.

agent-bom db update --osv-ecosystem PyPI covers only the selected ecosystem; add the ecosystems you need before running agent-bom scan . --offline. The full agent-bom db update --source osv archive can exceed 1 GB; the command shows live progress. A non-zero exit can mean a security gate or incomplete assessment: inspect the report and coverage. Exit codes

Context Map: inspect agents, MCP servers, packages and credential references. The map above uses labeled sample data; recorded relationships do not prove execution or data access. Click any screenshot to view it at full size. To trace one vulnerable dependency to the affected agents and into remediation, try the connected-BOM walkthrough.

Self-host in your environment

Your infrastructure, your identity, your database, your audit boundary. From a published release checkout:

git clone --depth 1 --branch v0.108.4 https://github.com/koda-ai-studio/agent-bom.git && cd agent-bom
AGENT_BOM_IMAGE_TAG=0.108.4 docker compose up -d

Open http://localhost:3000, then Connections or New Scan. For cloud accounts, add a scoped read-only connection, verify access, then start a scan. The pilot binds to loopback and retains state in a Docker volume. Use the authenticated deployment guide for a shared instance.

Shared deployment: Agent-Bom + PostgreSQL + your chosen identity provider. Local CLI/CI scans need no database service or login stack. Grafana/Prometheus and ClickHouse are optional. Choose the stack.

Deployment models

Start with	Guide
Local evaluation	Docker pilot
Shared control plane	Authenticated deployment · Compose with PostgreSQL
Kubernetes or AWS	Helm · EKS Terraform
Restricted networks	Air-gapped bundle
Snowflake preview	Native App installation

Choose a deployment · Enterprise configuration · Connect cloud accounts

Use CLI or GitHub Action, REST API, or MCP; export SARIF, CycloneDX, SPDX, JSON and HTML. Cloud connectors and fleet sync collect inventory; proxy and gateway deployments add runtime evidence.

For coding assistants, run agent-bom mcp server. Start with eight focused tools, then choose a graph, cloud, runtime or audit profile. The full catalog has 89 MCP tools, 7 resources, and 8 workflow prompts in current source. MCP workflows

Integration capability matrix · MCP client setup · Proxy, gateway and fleet · Smithery setup and manifest

Built for the teams that build, secure and govern AI

Your team	What you can do
Developers & AI engineers	Inspect repositories, dependencies and MCP configuration; bring findings into CI and coding assistants.
AppSec & cloud security	Connect cloud accounts, trace findings through workloads and identities, and prioritize fixes using recorded exposure and evidence gaps.
Platform & DevOps	Run a shared control plane, collect fleet evidence, and apply policy to MCP traffic through the proxy or gateway.
GRC & audit	Open Compliance to review mappings and export scan evidence with its source, freshness and assessment gaps.
Security & engineering leaders	Open Overview to review posture, remediation priorities and tracked AI spend across connected sources.
AI assistants & automation	Use MCP workflows to query evidence and inspect findings within the caller’s permissions.

Product tour

Security, engineering and GRC: prioritize findings

Start with Posture, inspect evidence in Top risks, and scope inventory in Assets & coverage. Compliance separates evaluated-control pass rate from assessment coverage. OWASP and MITRE ATLAS risk mappings describe applicability, not control pass/fail. The offline synthetic enterprise estate shown below includes evaluated checks; results do not establish certification or an audit opinion.

Explore expanded framework evidence, Top risks, scoped Inventory, recorded scan history, framework controls and evidence, and the per-agent BOM preview.

AppSec and cloud teams: investigate a finding

Follow CVE-2023-4863 in pillow@9.0.0 through recorded relationships between the service, workload, container, tool and modeled data asset. Inspect the source receipts and carry the selected finding into remediation. A recorded path does not by itself prove exploitation or successful data access.

Choose a scope in Summary, then Inspect an entity. Filter by type or severity, set direction and hop limits, and expand bounded pages; incomplete views are labeled. In Context, use Focus here, Back, or an exact identifier. Select a node or arrow to inspect its evidence, freshness and unknowns. Investigate reach & permissions opens permission receipts, CVE prerequisites and related activity; missing exploitability stays not assessed. Investigation workflow.

Connect data locations to security evidence. Explore recorded stores and datasets alongside identities and findings. Distinguish storage, access evidence and collection sources; derived classifications do not prove contents or successful reads. Data and evidence model.

Engineers and GRC: fix and verify

Connect the upgrade decision, the responsible owner and the evidence needed to close the risk.

Decision	Engineering and governance evidence
What do we fix first?	Prioritize package upgrades using severity, recorded agent and credential associations, and available fixes.
Who owns the work?	Assign owners and SLAs, link tickets, and track remediation campaigns.
Did the fix hold?	Re-scan the same scope, compare retained findings, and verify the campaign before closing it.
What supports the control review?	Review evaluated checks, source receipts and assessment gaps; export scoped evidence. A control mapping alone is not a passing check.

Run the before-and-after dependency example · Review component control evidence · Compliance evidence workflow

These are application captures, not mockups. Overview, Findings and remediation use labeled sample data. Re-scan your own scope for current versions and fixes. The investigation graph uses the reproducible reference lab: real parsers, a pinned advisory scan and authenticated gateway calls, with modeled infrastructure. A blocked call does not establish that the underlying package was fixed.

Discover and scan · Runtime policy and agent workflows · Run the reference evidence lab · Evidence workflow · Control-plane architecture

Trust and evidence

Discovery uses read-only access by default. Explicit disk side-scans create temporary cloud resources; runtime enforcement acts on selected tool calls. Missing evidence stays unavailable or partial. Control mappings are not audit certification.

Product boundaries · Permissions · Threat model · Security policy · Release verification · Measured matcher proof · Graph workload: command, receipt and limits

Contributing and support

Contributing · Capabilities and roadmap · Support · Open issues · Apache-2.0 license

Source version: v0.108.4 · Latest release: v0.108.4 · Changelog