agent-bom ingest

This Skill addresses the problem of validating cloud resource inventories and performing local security audits. In day-to-day operations, teams often need to export asset inventories from multiple cloud platforms like AWS, Azure, and GCP. However, directly handing these inventories over to third-party tools or uploading them to the cloud poses security risks. This tool allows users to perform format validation, vulnerability scanning, and policy assessment locally on the inventory file without exposing cloud credentials. It can also generate export results suitable for auditing, compliance checks, or graphical presentation.

Usage is straightforward. You simply prepare a JSON-formatted inventory file that conforms to the built-in schema, which can originate from a CMDB, an endpoint collector, or an AI Agent workflow. Then, run agent-bom mcp validate inventory.json for format validation, followed by agent-bom scan --inventory inventory.json --format json --output findings.json for local scanning. Finally, you can export the results to formats like SARIF, HTML, Markdown, or CycloneDX as needed. Using natural language instructions, an AI assistant can automatically chain these steps, for example: "Validate my AWS inventory.json and generate an HTML audit report."

It is ideally suited for operations teams, security auditors, and compliance departments that require strict control over cloud resource security. This is particularly valuable for organizations that already have a mature CMDB or endpoint collector but wish to analyze inventories without trusting third-party tools. For enterprises needing to submit audit materials to regulators, this tool can generate trusted local evidence without exposing cloud credentials.

It is recommended to use this tool for local validation each time a new inventory is exported from a cloud platform to ensure data integrity and security. Note that the tool requires the inventory to strictly comply with the packaged inventory.schema.json contract, otherwise it will error. Also, it does not automatically connect to cloud platforms; all data must be manually provided via JSON files. The optional cloud push feature requires the user to explicitly provide a target URL and authentication method. The tool includes built-in sensitive information masking to ensure credentials are not printed or leaked.