agent-bom ingest

This Skill addresses the challenge of unifying validation and local analysis for cross-cloud asset inventory data. In real-world operations, inventory JSON files exported from AWS, Azure, GCP, Snowflake, or CMDBs often have varying formats. Using them directly can lead to compliance oversights or misjudgments due to data inconsistencies.

Usage is straightforward: simply provide a standardized inventory JSON file (e.g., inventory.json), then run agent-bom mcp validate to check the schema, followed by agent-bom scan to perform a local scan and generate findings reports in formats like JSON, SARIF, or HTML. After that, you can use natural language prompts to query risks, export audit evidence, or push results to your own dashboard.

It is particularly well-suited for operations and security teams that need to regularly inventory cloud assets and generate compliance audit reports—especially those who already obtain standardized inventory JSON via scripts or collectors but prefer not to share cloud credentials with third-party tools.

We recommend integrating this tool into your CI/CD pipeline to automatically validate inventory integrity before each deployment. Note that it primarily processes existing JSON files, does not support real-time cloud resource fetching, and requires strict adherence to the inventory.schema.json contract format.