msaad00/agent-bomOpen-source cloud and AI security platform: scan code, dependencies, containers, cloud and AI agents/MCP into one security graph. Self-host free in your own environment.
<p align="center"> <img src="https://raw.githubusercontent.com/msaad00/agent-bom/main/docs/images/social-preview.svg" alt="agent-bom — Discover. Scan. Correlate. Act. Security evidence across repositories, software supply chains, AI and MCP, cloud, identity, and data." width="1280" /> </p> <p align="center"> <a href="https://github.com/koda-ai-studio/agent-bom/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/koda-ai-studio/agent-bom/ci.yml?branch=main&style=flat&label=Build" alt="Build"></a> <a href="https://pypi.org/project/agent-bom/"><img src="https://img.shields.io/pypi/v/agent-bom?style=flat&label=PyPI&cacheSeconds=60" alt="PyPI"></a> <a href="https://pypi.org/project/agent-bom/"><img src="https://img.shields.io/badge/Python-3.11%E2%80%933.14-blue?style=flat" alt="Python 3.11 through 3.14"></a> <a href="https://hub.docker.com/r/agentbom/agent-bom"><img src="https://img.shields.io/docker/pulls/agentbom/agent-bom?style=flat&label=Docker%20pulls" alt="Docker pulls"></a> <a href="https://github.com/msaad00/agent-bom/blob/main/LICENSE"><img src="https://img.shields.io/badge/License-Apache%202.0-blue?style=flat" alt="Apache-2.0 license"></a> <a href="https://securityscorecards.dev/viewer/?uri=github.com/koda-ai-studio/agent-bom"><img src="https://img.shields.io/ossf-scorecard/github.com/koda-ai-studio/agent-bom?style=flat&label=OpenSSF%20scorecard" alt="OpenSSF Scorecard"></a> <a href="https://glama.ai/mcp/servers/koda-ai-studio/agent-bom"><img src="https://img.shields.io/badge/MCP-Glama-7c3aed?style=flat" alt="Glama MCP server"></a> <a href="https://smithery.ai/servers/agentbom/agent-bom"><img src="https://img.shields.io/badge/MCP-Smithery-1f6feb?style=flat" alt="Smithery MCP server"></a> </p> <!-- mcp-name: io.github.koda-ai-studio/agent-bom --> <p align="center"><b>Find vulnerable software behind your AI agents—and trace the exposure evidence.</b></p> **Open security scanner and self-hosted control plane for AI, MCP, and cloud infrastructure.** For AppSec and platform engineers responsible for AI agents and MCP servers: scan a repository, correlate its findings with agent and infrastructure context, and prioritize fixes by blast radius and reachability evidence. Local scans need no account. <p align="center"> <a href="#quick-start"><b>Quick start</b></a> · <a href="#integrations">Integrations</a> · <a href="#open-the-sample-graph">Sample graph</a> · <a href="#self-host-in-your-environment">Self-host</a> · <a href="https://github.com/msaad00/agent-bom/blob/main/docs/GALLERY.md">Product tour</a> · <a href="https://koda-ai-studio.github.io/agent-bom/">Docs</a> </p> ## Quick start From the repository you want to inspect: ```bash pip install agent-bom agent-bom scan . ``` Read the inventory, findings, coverage gaps, and remediation guidance in the terminal. Save a report with `agent-bom scan . -f sarif -o findings.sarif`, then [upload it and gate CI](https://github.com/msaad00/agent-bom/blob/main/docs/FIRST_RUN.md#5-gate-ci-on-the-result). Run `agent-bom doctor` if setup fails. See the [first-run guide](https://github.com/msaad00/agent-bom/blob/main/docs/FIRST_RUN.md). In GitHub Actions, the same scan uploads SARIF to code scanning and fails on new high or critical findings, the same default gate as the CLI: ```yaml permissions: contents: read security-events: write steps: - uses: actions/checkout@v4 - uses: koda-ai-studio/agent-bom@v0 ``` No project handy? Run `agent-bom scan --demo --offline` for a bundled sample. Exit `1` is expected: the sample trips the security gate. A non-zero exit can mean a security gate or incomplete assessment; inspect the report and coverage. See the [exit codes](https://github.com/msaad00/agent-bom/blob/main/site-docs/reference/exit-codes.md). <p align="center"><img src="https://assets.kitploit.com/production/public/readmes/13617/02059de421497d226ac0ea7ecc75eec392bff2204adc5ec0eed3facea08515c8/f5e9bfe6fa64a65489b0860075b31bd6c58a75e563d5726a996558e266bde59c-display-v1.webp" alt="Recorded agent-bom CLI showing sample findings and remediation guidance; no fix executed" width="920" /></p> The recording uses labeled sample data and bundled advisories. Credential references are names, not secret values. Recorded relationships do not prove exploitation or successful data access. ## What it covers | Area | What you get | |---|---| | Dependencies | Lockfiles and manifests across Python, JavaScript, Go, Java, .NET, Rust and more, matched against OSV, GitHub advisories and NVD with KEV and EPSS. Ask "am I affected by CVE-X" across every stored scan. | | Code | Findings from Semgrep or any SARIF tool, plus native analysis of AI code (prompt-injection sinks, guardrails, tool exposure) and whether your code reaches the vulnerable function. | | Containers and IaC | Images scanned in bounded memory and time; Dockerfile, Terraform, Kubernetes, Helm and compose risks with exact lines in SARIF. | | AI agents and MCP | Agents, MCP servers, tools and credentials from local configs and agent frameworks, linked to what they can reach. | | Cloud | Read-only collection from AWS, Azure, GCP, Databricks, Snowflake and more, with CIS and best-practice checks in the same graph. | | Runtime | An MCP proxy and gateway that alert on poisoned tools and injected results, or block them with `--injection-mode enforce`. | ## Investigate context and exposure **Which agent uses the vulnerable component? What could it reach? What evidence supports that path?** Correlate retained scans by exact, tenant-scoped identities; trace the recorded blast radius from each agent through its MCP servers to packages, findings, credentials and data stores. Inspect each relationship's source and evidence kind, then rescan the same scope to check what changed. <p align="center"><a href="https://github.com/msaad00/agent-bom/blob/main/docs/images/graph-environment-dark-live.png"><picture><source media="(prefers-color-scheme: light)" srcset="docs/images/graph-environment-light-live.png"><img src="https://assets.kitploit.com/production/public/readmes/13617/a9820e449da22081a9c027d41e14ae14f4ef8cb7497612fa95e22ebbca717c32/63365b8cdcd2e414e44cc59f2b76147ebb9557a3121bfb554bb7c89516c2de8d-display-v1.webp" alt="Sample production AI environment: Document Intake Agent uses a document-tools MCP server that depends on pillow 9.0.0, linked to KEV-listed CVE-2023-4863; Support Triage Agent uses a ticketing MCP server that references TICKETING_API_KEY, which can access a customer ticket archive" width="1100"></picture></a></p> *Fictional sample estate. Dashed use, credential and access links are configured or modeled, not observed at runtime; path analysis covers the collected snapshot only.* [Open the full-size environment graph](https://github.com/msaad00/agent-bom/blob/main/docs/images/graph-environment-dark-live.png). **From agent to verified fix:** select Document Intake Agent → inspect CVE-2023-4863 (high, KEV-listed) and the evidence on each arrow → take the proposed [remediation](https://github.com/msaad00/agent-bom/blob/main/docs/GALLERY.md#engineers-and-grc-fix-and-verify) → [rescan the changed pin](https://github.com/msaad00/agent-bom/blob/main/examples/connected-bom/README.md) and compare snapshots. The comparison verifies the changed input, not a running deployment. **Supporting evidence: one package, three parsed inputs.** A repository pin, an image SBOM and a modeled Kubernetes workload resolve to one `[email protected]`. The image inventory and the deployment occurrence stay separate nodes; the advisory receipt is open. <p align="center"><a href="https://github.com/msaad00/agent-bom/blob/main/docs/images/graph-relationship-dark-live.png"><picture><source media="(prefers-color-scheme: light)" srcset="docs/images/graph-relationship-light-live.png"><img src="https://assets.kitploit.com/production/public/readmes/13617/b828c33d14899e67709da2ed249008e17577814303a43e7c36e22aad0917dc72/4cc94bbce4d711f10c987dddda1522436fb5f68a4edd49abca4e9df5be747824-display-v1.webp" alt="Repository pin, image inventory and Kubernetes deployment occurrence resolving to one pillow package linked to KEV-listed CVE-2023-4863, with the plain-language relationship evidence open" width="1100"></picture></a></p> *Real parsers, modeled infrastructure; a graph path does not prove exploitation.* [Open the full-size relationship graph](https://github.com/msaad00/agent-bom/blob/main/docs/images/graph-relationship-dark-live.png). [Explore context, correlation and reachability](https://github.com/msaad00/agent-bom/blob/main/docs/GALLERY.md#context-correlation-and-reachability) · [Run the reference lab](https://github.com/msaad00/agent-bom/blob/main/examples/reference-evidence-lab/README.md) · [Reproduce these screenshots](https://github.com/msaad00/agent-bom/blob/main/docs/GALLERY.md#reproduce-the-readme-screenshots) Explain a finding to your team: [create an impact brief](https://github.com/msaad00/agent-bom/blob/main/docs/operations/IMPACT_BRIEF.md) with affected assets, source receipts, evidence gaps and the next action to review. Am I affected by a new CVE? [Respond to a new CVE](https://github.com/msaad00/agent-bom/blob/main/docs/RESPOND_TO_A_NEW_CVE.md): match it against stored scans, including CVEs only NVD has published, and get affected assets with their patch target, possibly affected distro packages to verify, and the blast radius. <details> <summary>Repository and cloud investigations</summary> Trace source imports, deployment configuration and CI to a published container and its vulnerable packages: <p align="center"><a href="https://github.com/msaad00/agent-bom/blob/main/docs/images/graph-repository-dark-live.png"><picture><source media="(prefers-color-scheme: light)" srcset="docs/images/graph-repository-light-live.png"><img src="https://assets.kitploit.com/production/public/readmes/13617/c5d971fd26a6bcbb6ef60e503417f47cfe41b4e1a90497a7cb447a5c02b804e9/214da25c8520d956dc07f84b0683fd51eab4cf62fdec044df9504728c8e7aa94-display-v1.webp" alt="Sample repository linking source, deployment configuration and a CI job to a container, vulnerable npm and PyPI packages, their advisories and a CI misconfiguration" width="1100"></picture></a></p> Follow a public API gateway into a vulnerable workload, its role and a PII bucket: <p align="center"><a href="https://github.com/msaad00/agent-bom/blob/main/docs/images/graph-cloud-dark-live.png"><picture><source media="(prefers-color-scheme: light)" srcset="docs/images/graph-cloud-light-live.png"><img src="https://assets.kitploit.com/production/public/readmes/13617/4a92a1a1d6ec506f9568c58a55de72a180c25906d795e2787728fd00ca613add/af05402775a4aef68cae193068301b6646f7c00c7497092f3d28eef3e998ec00-display-v1.webp" alt="Sample cloud account where a public API gateway exposes a workload with a critical advisory that authenticates as a role permitted to read a PII bucket" width="1100"></picture></a></p> </details> ## Open the sample graph [Try the demo in your browser](https://koda-ai-studio.github.io/agent-bom/demo/): a read-only copy of the UI on labelled sample data, with no install and no backend. Scans, settings and sign-in are turned off there. To open the same graph locally: ```bash pip install 'agent-bom[ui]==0.110.0' agent-bom quickstart --run --offline ``` Run the server command it prints, then open its graph URL. Offline quickstart skips package-CVE lookup, so zero CVEs is not a clean verdict; use the bundled demo for advisory-backed findings or [populate the advisory database](https://github.com/msaad00/agent-bom/blob/main/docs/FIRST_RUN.md). ## Self-host in your environment **Your infrastructure, identity, database, and audit boundary.** Start a local pilot from a [published release checkout](https://github.com/koda-ai-studio/agent-bom/releases): ```bash git clone --depth 1 --branch v0.110.0 https://github.com/koda-ai-studio/agent-bom.git && cd agent-bom AGENT_BOM_IMAGE_TAG=0.110.0 docker compose up -d ``` Open **http://localhost:3000**, then **Connections** or **New Scan**. The pilot binds to loopback and retains state in a Docker volume. For cloud accounts, add a scoped read-only connection, verify access, then start a scan. Use the [authenticated deployment](https://github.com/msaad00/agent-bom/blob/main/site-docs/deployment/authenticated-hosted-instance.md). - **Scan** with CLI or CI; export findings, SBOMs and reports. - **Centralize** inventory, graph evidence, remediation and compliance in your own control plane. - **Enforce** policy on selected live MCP tool calls through the proxy or gateway. [Docker pilot guide](https://github.com/msaad00/agent-bom/blob/main/docs/DEPLOY_PLATFORM.md) · [Compose with PostgreSQL](https://github.com/msaad00/agent-bom/blob/main/deploy/docker-compose.platform.yml) · [Choose a deployment](https://github.com/msaad00/agent-bom/blob/main/site-docs/deployment/overview.md) · [Enterprise controls](https://github.com/msaad00/agent-bom/blob/main/docs/TRUST.md) · [Connect cloud accounts](https://github.com/msaad00/agent-bom/blob/main/docs/CLOUD_CONNECT.md) <details> <summary>Work with your existing tools</summary> Use **CLI or GitHub Action**, **REST API**, or **MCP**; export **SARIF, CycloneDX, SPDX, JSON and HTML**. Cloud connectors and fleet sync collect inventory; proxy and gateway deployments add runtime evidence. For other MCP clients, run `agent-bom mcp server`. Start with eight focused tools in the default profile. [Choose an MCP profile](https://github.com/msaad00/agent-bom/blob/main/docs/MCP_SERVER.md) for graph, cloud, runtime or audit work. [Try three investigations](https://github.com/msaad00/agent-bom/blob/main/docs/MCP_SERVER.md): affected agents, exposure receipts and a before/after scan comparison. [Import existing scanner reports](https://github.com/msaad00/agent-bom/blob/main/docs/IMPORTERS.md) without replacing their source evidence. Prefer an isolated invocation? Use `uvx agent-bom scan .` or check a dependency with `uvx agent-bom check [email protected] --ecosystem pypi`. Add [pre-commit and CI setup](https://github.com/msaad00/agent-bom/blob/main/docs/FIRST_RUN.md#pre-commit-hook) for repeated checks. [Proxy, gateway and fleet](https://github.com/msaad00/agent-bom/blob/main/site-docs/deployment/proxy-vs-gateway-vs-fleet.md) · [Integration capability matrix](https://github.com/msaad00/agent-bom/blob/main/docs/CLOUD_CONNECT.md) · [MCP client setup](https://github.com/msaad00/agent-bom/blob/main/docs/MCP_SERVER.md) · [Smithery setup and manifest](https://github.com/msaad00/agent-bom/blob/main/site-docs/integrations/smithery.md) </details> ## Integrations <details> <summary><b>Claude Code and Codex plugins</b>: ask your coding agent instead of reading a report</summary> Ask your coding agent instead of reading a report. In Claude Code: ```text /plugin marketplace add koda-ai-studio/agent-bom /plugin install agent-bom@agent-bom ``` In Codex, run `codex plugin marketplace add koda-ai-studio/agent-bom`, then install **agent-bom-local** from the Plugins Directory. Both plugins run the pinned agent-bom release locally and send nothing to an agent-bom service. | Ask | Skill | |---|---| | "Is this project safe to ship?" | `checkup`: one verdict and the three fixes that matter most | | "Am I affected by CVE-2025-29927?" | `affected`: affected or not found in what was scanned, never "safe" | | "What have my agents been doing?" | `activity`: MCP usage, unused servers, risky commands from local session history | | "Are my agent settings too permissive?" | `audit-mcp` and `audit-skills` | | "Give me an AI-BOM" | `bom`: CycloneDX or SPDX for this machine, a project, an image or a cloud account | Add `/plugin install agent-bom-guard@agent-bom` to block malicious and typosquatted package installs before Claude runs them. [All skills and their permissions](https://github.com/msaad00/agent-bom/blob/main/integrations/claude-code/README.md) · [Guard details](https://github.com/msaad00/agent-bom/blob/main/integrations/agent-bom-guard/README.md) </details> ## Trust and evidence Discovery uses read-only access by default. Explicit disk side-scans create temporary cloud resources. Missing evidence stays unavailable or partial; control mappings are not audit certification. Persisted runtime, proxy and gateway activity retains source receipts and bounded time windows in the graph. Exact inventory references can bind records; unresolved identities and collection gaps remain explicit. Recorded activity does not prove execution or grant access. See the [runtime evidence boundaries](https://github.com/msaad00/agent-bom/blob/main/docs/TRACE_CONNECTIONS.md). MITRE technique associations provide investigation context, not proof of an attack. [ATLAS mapping receipts](https://github.com/msaad00/agent-bom/blob/main/docs/ATLAS_COVERAGE.md) retain the weakness association and source catalog hashes; modeled graph paths do not establish observed execution or effective access. [Measured matcher proof](https://github.com/msaad00/agent-bom/blob/main/site-docs/features/scanning.md#reproducible-matching-evidence) · [Product boundaries](https://github.com/msaad00/agent-bom/blob/main/docs/PRODUCT_BOUNDARIES.md) · [Permissions](https://github.com/msaad00/agent-bom/blob/main/docs/PERMISSIONS.md) · [Threat model](https://github.com/msaad00/agent-bom/blob/main/docs/THREAT_MODEL.md) · [Release verification](https://github.com/msaad00/agent-bom/blob/main/docs/RELEASE_VERIFICATION.md) · [Graph data model](https://github.com/msaad00/agent-bom/blob/main/docs/graph/DATA_MODEL.md) ## Contributing and support [](https://codespaces.new/koda-ai-studio/agent-bom) New here? The [first PR in 30 minutes](https://github.com/msaad00/agent-bom/blob/main/CONTRIBUTING.md#your-first-pr-in-30-minutes) guide and a ready Codespace get you from zero to a passing test without local setup. Start with a [`good first issue`](https://github.com/koda-ai-studio/agent-bom/issues?q=is%3Aopen+label%3A%22good+first+issue%22) or the [contributor roadmap](https://github.com/msaad00/agent-bom/blob/main/docs/ROADMAP.md), and ask in `#contributors` on [Discord](https://discord.gg/3YmYPqKZh5). agent-bom wants more maintainers: [GOVERNANCE.md](https://github.com/msaad00/agent-bom/blob/main/GOVERNANCE.md) lays out the path from contributor to triager, reviewer and maintainer, and [MAINTAINERS.md](https://github.com/msaad00/agent-bom/blob/main/MAINTAINERS.md) lists who reviews what. If agent-bom gave you useful evidence, a star or a short note in [feedback](https://github.com/koda-ai-studio/agent-bom/issues/new?template=feedback.yml) helps other security teams find and trust it. [Contributing](https://github.com/msaad00/agent-bom/blob/main/CONTRIBUTING.md) · [Capabilities and roadmap](https://github.com/msaad00/agent-bom/blob/main/docs/ROADMAP.md) · [Support](https://github.com/msaad00/agent-bom/blob/main/SUPPORT.md) · [Report an inaccurate finding](https://github.com/koda-ai-studio/agent-bom/issues/new?template=inaccurate_finding.yml) · [Apache-2.0](https://github.com/msaad00/agent-bom/blob/main/LICENSE) Source version: **v0.111.0** · Latest release: **v0.110.0** · [Changelog](https://github.com/msaad00/agent-bom/blob/main/CHANGELOG.md)
