agent-bom-scan — AI Supply Chain Vulnerability Scanner

Checks packages for CVEs, scans container images natively, verifies package provenance via Sigstore, scans filesystems, and generates SBOMs.

Install

pipx install agent-bom
agent-bom check langchain==0.1.0  # check a specific package with version
agent-bom scan --project . --no-discover  # scan the requested project
agent-bom scan --image nginx:1.25 --no-discover  # scan the requested image
agent-bom scan --sbom sbom.json --no-discover  # scan a supplied SBOM
agent-bom scan --project . --no-discover -f cyclonedx -o sbom.json  # requested output
agent-bom verify agent-bom   # verify Sigstore provenance

Choose the Target First

Use the narrowest input that satisfies the request. If the package/version, repository, image or SBOM is missing, ask for it. Do not interpret a generic "verify" or "is this safe" as permission to scan the host.

For explicit CLI targets, pass --no-discover; for the MCP scan tool, pass no_discover=True. An invalid, empty or unreadable target is a collection gap, not permission to fall back to home-directory or MCP-client discovery. Report the gap and ask for a valid target.

Home-directory configuration and MCP-client discovery require an explicit user request for those sources. The file_reads list discloses possible inputs; it does not authorize reading them. Do not use discovered cloud credentials. Cloud inventory requires the separately authorized cloud discovery skill.

Scans can write local state and vulnerability caches. Write reports or SBOMs only to requested output paths. Offline scans may have incomplete advisory coverage; preserve that qualification in the result.

As an MCP Server

{
  "mcpServers": {
    "agent-bom": {
      "command": "uvx",
      "args": ["agent-bom", "mcp", "server"]
    }
  }
}

When to Use

• Check a named package and version for vulnerabilities.
• Scan a specified image, repository or SBOM.
• Look up a named CVE or advisory.
• Generate an SBOM for a specified project.
• Discover local MCP clients when the user explicitly requests that scope.

Tools (8)

These are the default scan MCP profile tools. Additional tools such as registry_lookup require a profile that advertises them; inspect the connected server's tool list before calling one. CLI commands such as verify and diff are not default MCP tools. Supply explicit inputs to tools that can discover clients when their target is omitted, including compliance and generate_sbom.

Examples

# Check a package before installing
check(package="langchain", version="0.1.0", ecosystem="pypi")

# Look up an advisory in the local database
intel_lookup(advisory_id="CVE-2024-21538")

# Scan only the project the user requested
scan(config_path="/authorized/project", no_discover=True)

Agentic Workflows

Use tool chains, not isolated calls, when the user asks for a decision:

Pick output by consumer: SARIF for CI, JSON for automation/graph, HTML or Markdown for human review, CycloneDX/SPDX for SBOM consumers.

For CLI gates, prefer:

agent-bom scan --project . --no-discover --format sarif --output agent-bom.sarif --fail-on-severity high

Guardrails

• Show CVEs even when NVD analysis is pending or severity is unknown — a CVE ID is still a real finding.
• Treat UNKNOWN severity as unresolved, not benign — it means data is not yet available.
• Do not install packages, execute discovered commands, edit dependencies or change system configuration as part of a scan. Installation in the setup example is a separate user action.
• Allow only the scanner's local state/cache writes and explicitly requested reports; do not overwrite unrelated files.
• Online lookups transmit package identifiers and versions. Confirm permission before querying private identifiers, or use offline mode and report its coverage gaps.
• Read only the authorized targets, whether inside or outside the user's home directory. Never print raw credentials or upload configuration contents.

Privacy & Data Handling

# Step 1: Install
pip install agent-bom

# Step 2: Review redaction logic BEFORE scanning
# sanitize_env_vars() redacts credential-like and sensitive env values before
# reporting; benign configuration values may remain in the in-memory model:
# https://github.com/msaad00/agent-bom/blob/main/src/agent_bom/security.py

# Step 3: Verify package provenance (Sigstore)
agent-bom verify agent-bom

# Step 4: Scan only the requested project
agent-bom scan --project . --no-discover

Verification

• Source: github.com/msaad00/agent-bom (Apache-2.0)
• Sigstore signed: agent-bom verify agent-bom@0.108.4
• Contracts: tests/test_bundled_skill_contract.py checks skill metadata and the default MCP tool list.
• Network boundary: Online scans use vulnerability providers and the explicitly requested repository or image host; use offline mode when those requests are not authorized.