agent-bom ingest

This Skill addresses the need for secure, offline processing of multi-platform inventory JSON files in cloud asset auditing. In real-world operations, teams often export asset inventories from platforms like AWS, Azure, GCP, or CMDBs. However, scanning directly using cloud credentials poses security risks, and a unified format is required for compliance analysis.

Usage is straightforward: simply prepare a JSON file conforming to the schema, then run agent-bom mcp validate inventory.json to verify the format, followed by agent-bom scan --inventory inventory.json --format json --output findings.json to perform a local scan. Afterward, you can use natural language commands to export reports in formats like SARIF, HTML, or Markdown for auditing, policy checks, or graph analysis.

It is ideal for teams or individuals needing unified auditing of multi-cloud assets and enhanced security compliance, especially those who have already generated standard JSON via endpoint collectors or CMDBs. Whether for security audits by operations engineers or compliance reporting by project managers, deep analysis can be completed without exposing cloud credentials.

It is recommended to use this tool after standardizing the asset inventory schema, ensuring the JSON strictly adheres to inventory.schema.json. Note that it primarily relies on local scanning capabilities; optional vulnerability queries will call external OSV and GitHub Advisory APIs but will not upload your asset data. Control plane pushes require the user to provide a URL and Token, and credentials must never be disclosed in conversations.