agent-bom registry
MCP Server Security Registry and Trust Assessment Tool
Install & Use
Copy this prompt and send it to your AI assistant (Claude / Cursor / TRAE / Codex / WorkBuddy etc.) to auto-install:
Help me install this AI Skill: agent-bom registry. It is used for: MCP Server Security Registry and Trust Assessment Tool Full Skill content: https://321skill.com/skills/agent-bom-registry-x-10/raw/index.md Read that page and install it.
The prompt includes a link to the full Skill content. You can also view the full content.
This Skill addresses the pain points of MCP (Model Context Protocol) server security assessment and trust evaluation. In practical development, developers need to integrate numerous third-party MCP servers but lack unified security metadata, making it difficult to determine if a server has known vulnerabilities, malicious behavior, or compliance risks. This tool includes a built-in registry of 1013 MCP server security metadata records, enabling quick lookup, assessment, and batch scanning.
Usage is straightforward: simply install the agent-bom package via pipx, and you can invoke it from the terminal or through an AI agent. It supports seven core tools: registry_lookup for finding server security records, marketplace_check for pre-installation trust verification, fleet_scan for batch risk scoring, skill_scan/skill_verify/skill_trust for evaluating the trust level of AI instruction files (SKILL.md), and code_scan for SAST code scanning via Semgrep. You can then execute various security audit operations using natural language commands.
It is well-suited for teams and individuals building secure AI workflows, especially agent developers, DevOps engineers, and security auditors already using the MCP protocol to integrate external servers. It is particularly useful for scenarios requiring batch assessment of MCP server supply chain risks and ensuring the trustworthiness of AI skill file sources.
It is recommended to use this tool for unified trust pre-checks before deploying any MCP server. Note that it primarily relies on locally bundled registry data (1013 records) and does not require network access; however, SAST code scanning requires optional installation of Semgrep, and the optional environment variable SNYK_TOKEN can be used for third-party vulnerability enhancement. All data is processed locally, and no API keys are needed.
Key Features
Unlike the official MCP directory or community listings, it provides a structured security metadata registry (1013 records) with a risk scoring mechanism, supporting batch scanning and skill file trust assessment, rather than merely listing server names.
Limitations
Requires Python 3.11+ environment; the registry data includes only 1013 pre-populated records, so newly emerged MCP servers may not be covered; SAST scanning depends on Semgrep (optional installation).
FAQ
How do I update the registry data?
The registry data is bundled within the package; you need to upgrade the `agent-bom` package to obtain the latest data.
Does it require an internet connection to function?
Core functionality works offline as registry data is processed locally; an internet connection is only needed when using the optional SNYK_TOKEN for vulnerability enhancement.
Installation guide for AI assistants
If your AI coding assistant (Claude Code, Cursor, TRAE etc.) can see this page, send it this message to auto-install:
Visit https://321skill.com/skills/agent-bom-registry-x-10/raw/index.md to read the original Skill definition (Markdown format) for agent-bom registry, and install it according to the instructions.
Raw Markdown URL for AI: /skills/agent-bom-registry-x-10/raw/index.md