agent-bom is an open-source security scanner and self-hosted control plane for AI agents and MCP servers, covering AI, MCP, and cloud infrastructure. Its target users are AppSec and platform engineers responsible for AI agents and MCP servers.
Key capabilities
- Scan repositories to discover vulnerable software behind AI agents, and correlate scan results with agent and infrastructure context.
- Prioritize issues based on blast radius and reachability evidence.
- Support local scanning with no account required; provides a self-hosted control plane for centralized management of inventory, graph evidence, remediation, and compliance.
- Can discover MCP clients, and can enforce policy on selected live MCP tool calls through a proxy or gateway.
- Support cloud account connectors and cluster synchronization to collect inventory; proxy and gateway deployments can add runtime evidence.
- Support exporting SARIF, CycloneDX, SPDX, JSON, and HTML reports; provide multiple ways to use it, including CLI, GitHub Action, REST API, or MCP.
How to use Run an agent-bom scan in the repository you want to inspect. The terminal will display inventory, findings, coverage gaps, and remediation guidance. You can use agent-bom scan . -f sarif -o findings.sarif to save a report, then upload it and set up a gate in CI. If setup fails, you can run agent-bom doctor. If you do not have a project, you can run agent-bom scan --demo --offline to use the built-in example; the example triggers the security gate, so exit code 1 is expected behavior, and a non-zero exit may indicate a security gate or incomplete assessment. The offline quick start skips package CVE queries, and zero CVEs does not mean it is completely clean; for findings with advisory support, you should use the built-in demo or populate the advisory database first.
Self-hosting You can check out a published release to start a local pilot, open http://localhost:3000，然后进入 Connections or New Scan. The pilot binds to the loopback address, and state is stored in a Docker volume. For cloud accounts, you can add a scoped read-only connection, verify access, and then start scanning; production use should adopt an authenticated deployment.
For coding assistants You can run agent-bom mcp server; the default configuration file provides eight focused tools; you can also choose MCP profiles for graph, cloud, runtime, or audit work. Existing scanner reports can be imported without replacing their source evidence. If you want isolated invocation, you can use uvx agent-bom scan . or uvx agent-bom check requests@2.33.0 --ecosystem pypi to check dependencies, and add pre-commit and CI setup for repeated checks.
Trust and evidence The discovery capability uses read-only access by default. Explicit disk bypass scanning creates temporary cloud resources. Missing evidence remains unavailable or partial; control mappings are not audit certifications. Recorded content uses labeled sample data and built-in advisories, credential references are names rather than secret values, and recorded relationships cannot prove that a vulnerability has been exploited or that data access succeeded. The project is licensed under Apache-2.0. The current source code version and the latest release version are both v0.108.4.
