Find vulnerable software behind your AI agents—and trace the exposure evidence.
For AppSec and platform engineers responsible for AI agents and MCP servers: scan a repository, correlate its findings with agent and infrastructure context, and prioritize fixes using blast radius and reachability evidence. Open security scanner and self-hosted control plane for AI, MCP, and cloud infrastructure. Local scans need no account.
Quick start · Sample graph · Self-host · Product tour · Docs
From the repository you want to inspect:
pip install agent-bom
agent-bom scan .Read the inventory, findings, coverage gaps, and remediation guidance in the terminal.
Save a report with agent-bom scan . -f sarif -o findings.sarif, then
upload it and gate CI.
Run agent-bom doctor if setup fails. See the first-run guide.
No project handy? Run agent-bom scan --demo --offline for a bundled sample.
Exit 1 is expected: the sample trips the security gate. A non-zero exit
can mean a security gate or incomplete assessment; inspect the report and coverage.
See the exit codes.
The recording uses labeled sample data and bundled advisories. Credential references are names, not secret values. Recorded relationships do not prove exploitation or successful data access.
Which agent uses the vulnerable component? What could it reach? What evidence supports that path? Correlate retained scans by exact, tenant-scoped identities; trace the recorded blast radius across packages, workloads, tools, identities and resources. Inspect each relationship's source and reachability basis, then rescan the same scope to check what changed.
Current-source preview; the published 0.108.4 UI predates this workspace.
Three independent sources resolve to one pillow@9.0.0 linked to KEV-listed
CVE-2023-4863. Real parsers, modeled infrastructure; a graph path does not
prove exploitation.
Explore context, correlation and reachability · Run the reference lab
Explore an environment, repository or cloud estate. Start with a scoped view, follow the ranked paths, and open any node or arrow for its source evidence. Badges show provider, environment tier and package ecosystem; rings mark the worst linked finding.
Sample estates: fictional names and IDs, published advisories.
Repository and cloud investigations
Trace source imports, deployment configuration and CI to a published container and its vulnerable packages:
Follow a public API gateway into a vulnerable workload, its role and a PII bucket:
pip install 'agent-bom[ui]==0.108.4'
agent-bom quickstart --run --offlineThe command writes a sample report and verifies its persisted graph. Run the server command it prints in another terminal, then open its exact graph URL. Keep that server running. The UI extra and server process are required.
Offline quickstart skips package-CVE lookup; zero CVEs is not a clean verdict. Use the bundled demo above for advisory-backed findings. For your own offline scan, first populate the advisory database.
Next, follow one component and a before/after rescan. That source-checkout example parses changed dependency inputs and retains both snapshots; it does not install packages or change a running deployment.
Your infrastructure, identity, database, and audit boundary. Start a local pilot from a published release checkout:
git clone --depth 1 --branch v0.108.4 https://github.com/koda-ai-studio/agent-bom.git && cd agent-bom
AGENT_BOM_IMAGE_TAG=0.108.4 docker compose up -dOpen http://localhost:3000, then Connections or New Scan. The pilot binds to loopback and retains state in a Docker volume. For cloud accounts, add a scoped read-only connection, verify access, then start a scan. Use the authenticated deployment.
- Scan with CLI or CI; export findings, SBOMs and reports.
- Centralize inventory, graph evidence, remediation and compliance in your own control plane.
- Enforce policy on selected live MCP tool calls through the proxy or gateway.
Docker pilot guide · Compose with PostgreSQL · Choose a deployment · Enterprise controls · Connect cloud accounts
Work with your existing tools
Use CLI or GitHub Action, REST API, or MCP; export SARIF, CycloneDX, SPDX, JSON and HTML. Cloud connectors and fleet sync collect inventory; proxy and gateway deployments add runtime evidence.
For coding assistants, run agent-bom mcp server.
Start with eight focused tools in the default profile.
Choose an MCP profile for graph, cloud, runtime or audit work.
Import existing scanner reports without replacing their source evidence.
Prefer an isolated invocation? Use uvx agent-bom scan . or check a dependency
with uvx agent-bom check requests@2.33.0 --ecosystem pypi. Add
pre-commit and CI setup for repeated checks.
Proxy, gateway and fleet · Integration capability matrix · MCP client setup · Smithery setup and manifest
Discovery uses read-only access by default. Explicit disk side-scans create temporary cloud resources. Missing evidence stays unavailable or partial; control mappings are not audit certification.
Measured matcher proof · Product boundaries · Permissions · Threat model · Release verification
Contributing · Capabilities and roadmap · Support · Report an inaccurate finding · Apache-2.0
Source version: v0.108.4 · Latest release: v0.108.4 · Changelog