agent-bom v0.98.1 — Open-source cloud and AI security platform: scan code, dependencies, containers, cloud and AI agents/MCP into one security graph. Self-host free in your own environment.

Find vulnerable software behind your AI agents—and trace the exposure evidence.

Open security scanner and self-hosted control plane for AI, MCP, and cloud infrastructure. For AppSec and platform engineers responsible for AI agents and MCP servers: scan a repository, correlate its findings with agent and infrastructure context, and prioritize fixes by blast radius and reachability evidence. Local scans need no account.

Quick start · Integrations · Sample graph · Self-host · Product tour · Docs

Quick start

From the repository you want to inspect:

pip install agent-bom
agent-bom scan .

Read the inventory, findings, coverage gaps, and remediation guidance in the terminal. Save a report with agent-bom scan . -f sarif -o findings.sarif, then upload it and gate CI. Run agent-bom doctor if setup fails. See the first-run guide.

In GitHub Actions, the same scan uploads SARIF to code scanning and fails on new high or critical findings, the same default gate as the CLI:

permissions:
  contents: read
  security-events: write
steps:
  - uses: actions/checkout@v4
  - uses: koda-ai-studio/agent-bom@v0

No project handy? Run agent-bom scan --demo --offline for a bundled sample. Exit 1 is expected: the sample trips the security gate. A non-zero exit can mean a security gate or incomplete assessment; inspect the report and coverage. See the exit codes.

Recorded agent-bom CLI showing sample findings and remediation guidance; no fix executed

The recording uses labeled sample data and bundled advisories. Credential references are names, not secret values. Recorded relationships do not prove exploitation or successful data access.

What it covers

Area	What you get
Dependencies	Lockfiles and manifests across Python, JavaScript, Go, Java, .NET, Rust and more, matched against OSV, GitHub advisories and NVD with KEV and EPSS. Ask "am I affected by CVE-X" across every stored scan.
Code	Findings from Semgrep or any SARIF tool, plus native analysis of AI code (prompt-injection sinks, guardrails, tool exposure) and whether your code reaches the vulnerable function.
Containers and IaC	Images scanned in bounded memory and time; Dockerfile, Terraform, Kubernetes, Helm and compose risks with exact lines in SARIF.
AI agents and MCP	Agents, MCP servers, tools and credentials from local configs and agent frameworks, linked to what they can reach.
Cloud	Read-only collection from AWS, Azure, GCP, Databricks, Snowflake and more, with CIS and best-practice checks in the same graph.
Runtime	An MCP proxy and gateway that alert on poisoned tools and injected results, or block them with `--injection-mode enforce`.

Investigate context and exposure

Which agent uses the vulnerable component? What could it reach? What evidence supports that path? Correlate retained scans by exact, tenant-scoped identities; trace the recorded blast radius from each agent through its MCP servers to packages, findings, credentials and data stores. Inspect each relationship's source and evidence kind, then rescan the same scope to check what changed.

Fictional sample estate. Dashed use, credential and access links are configured or modeled, not observed at runtime; path analysis covers the collected snapshot only. Open the full-size environment graph.

From agent to verified fix: select Document Intake Agent → inspect CVE-2023-4863 (high, KEV-listed) and the evidence on each arrow → take the proposed remediation → rescan the changed pin and compare snapshots. The comparison verifies the changed input, not a running deployment.

Supporting evidence: one package, three parsed inputs. A repository pin, an image SBOM and a modeled Kubernetes workload resolve to one [email protected]. The image inventory and the deployment occurrence stay separate nodes; the advisory receipt is open.