Open security scanner and self-hosted control plane for AI, MCP, and cloud infrastructure.
Live demo · Docs · First Run · Self-host · GitHub Action · Docker · Changelog
pip install agent-bom
agent-bom scan .Inventory, findings, reachability, and fix-first actions — no control plane
required. Export when another tool needs it:
agent-bom scan . -f sarif -o findings.sarif.
One finding links to the MCP servers that load it, reachable tools, credential
references, and agents that can reach it. Offline sample without your repo:
uvx agent-bom scan --demo --offline · full first-run path:
First Run.
- Scan —
agent-bom scan .→ inventory, findings, SARIF/SBOM/HTML, local graph - Control plane —
pip install 'agent-bom[ui]' && agent-bom serve→ tenant UI/API, attack paths, compliance, audit (self-host with Docker or Helm + Postgres) - Runtime —
agent-bom gateway serve --upstreams upstreams.yaml --bind 127.0.0.1:8090→ allow/warn/block on live MCP/tool calls
Discovery and static/cloud scanning are read-only. The control plane stores evidence; gateway/proxy modes make explicit policy decisions at a separate boundary.
Live demo is a read-only sandbox with synthetic showcase evidence. Prefer the local offline sample above when you want a reproducible CLI walkthrough. Captures below are from shipped Next.js routes.
| Findings and reach | Remediation |
|---|---|
 |
 |
More views — posture, runtime, connections, new scan
| Risk overview | Runtime gateway |
|---|---|
 |
 |
| Connections | New scan |
 |
 |
CLI walkthrough — 0.97.2 console demo
Seeded requests typosquat produces an expected non-zero security-gate exit —
a demonstrated finding, not a failed recording.
Capture list: docs/CAPTURE.md.
You run the control plane in your own boundary (no managed public SaaS in this repo yet):
curl -fsSL https://raw.githubusercontent.com/msaad00/agent-bom/main/deploy/docker-compose.pilot.yml -o docker-compose.pilot.yml
docker compose -f docker-compose.pilot.yml up -d
# Dashboard -> http://localhost:3000Pilot compose binds 127.0.0.1 with loopback CORS. Before sharing a link, use
docker-compose.platform.yml or docs/HOSTED_POC.md.
| Target | Start here |
|---|---|
| Docker Compose | pilot compose |
| Helm / Kubernetes | chart |
| EKS | Terraform module |
| CloudFormation | templates |
| Snowflake SPCS | install guide |
Guides: Deploy anywhere · deployment overview.
Surfaces and entry points
| Need | First action | Artifact |
|---|---|---|
| Scan repo / image / agent config | agent-bom scan . or GitHub Action |
JSON, SARIF, SBOM, HTML |
| Cloud / data estate | agent-bom connect aws then agent-bom cloud scan |
assets, CIS findings, graph edges |
| Team posture UI | pip install 'agent-bom[ui]' && agent-bom serve |
findings, graph, audit, compliance |
| MCP tools for agents | agent-bom mcp server |
strict MCP tool responses |
| Runtime tool governance | agent-bom gateway serve --upstreams upstreams.yaml --bind 127.0.0.1:8090 |
allow/warn/block audit |
| Audit package | agent-bom scan . -f sarif -o findings.sarif |
SARIF, CycloneDX, SPDX, bundles |
Also: agent-bom graph, agent-bom remediate -p ., CI pin
uses: msaad00/agent-bom@v0.97.2. Maps: CLI ·
start here · product map.
Who it is for
| Team | Start here | Outcome |
|---|---|---|
| Developers / AI builders | agent-bom scan . |
Inventory, findings, blast radius before changes ship |
| AppSec / security eng | agent-bom scan . -f sarif -o findings.sarif |
Reachability triage, graph paths, CI gates |
| Platform / SRE / cloud | agent-bom serve or Helm |
Customer-controlled API/UI, fleet evidence, runtime policy |
| GRC / audit | Compliance exports + control-plane evidence | Framework mappings, signed bundles, review context |
| AI / MCP owners | agent-bom mcp server or gateway serve |
Tool inventory and allow/warn/block decisions |
Evidence helper, not a GRC system of record, IAM, SIEM, or certification program. Coverage: AI infrastructure scanning · product boundaries.
Auth, connectors, and architecture
Control plane: connect once; later jobs use the stored connection reference. Humans: OAuth / OIDC / SAML (+ Snowflake OAuth PKCE) and SCIM. Agents/CI: scoped API keys. Secrets are write-only (encrypted at rest, never read back). Non-loopback deploys terminate TLS at the edge; API/UI stay on loopback or a private network.
Cloud connectors (opt-in, default-off, no secret values read):
| Cloud | Enable | Scan |
|---|---|---|
| AWS | AGENT_BOM_AWS_INVENTORY=1 |
agent-bom cloud aws |
| Azure | AGENT_BOM_AZURE_INVENTORY=1 |
agent-bom cloud azure |
| GCP | AGENT_BOM_GCP_INVENTORY=1 |
agent-bom cloud gcp |
| Snowflake | SSO or key-pair | pip install 'agent-bom[snowflake]' then agent-bom scan --snowflake |
CLOUD_CONNECT.md · DATA_SOURCES.md · ENTERPRISE.md.
Accuracy: match tiers
distro_confirmed > osv_range > osv_ecosystem > unfixed_distro > nvd_cpe_candidate.
End users do not need an NVD API key; NVD_API_KEY is an optional operator
freshness knob. MCP server mode exposes 76 MCP tools, 6 resources, and 8 workflow prompts
over strict arguments. Agent distribution includes a committed
Smithery manifest; external catalog liveness is
verified separately. Deep dive: ARCHITECTURE.md ·
vulnerability matching.
- Read-only discovery by default; no mandatory telemetry
- Credential values redacted; env names kept for explainable exposure paths
- Exports: JSON, SARIF, CycloneDX, SPDX, Parquet, CSV, Markdown, HTML, PDF, compliance bundles
- Tenant scope, auth boundaries, and audit evidence on API/runtime paths
Threat model · Pentest readiness · Python client · Go client · Release verification · MCP security model
Start with CONTRIBUTING.md, .agents/AGENTS.md, and the open issues.
License: Apache-2.0.