agent-bom registry
MCP Server Security Registration and Trust Assessment Tool
Install & Use
Copy this prompt and send it to your AI assistant (Claude / Cursor / TRAE / Codex / WorkBuddy etc.) to auto-install:
Help me install this AI Skill: agent-bom registry. It is used for: MCP Server Security Registration and Trust Assessment Tool Full Skill content: https://321skill.com/skills/agent-bom-registry-x-2/raw/index.md Read that page and install it.
The prompt includes a link to the full Skill content. You can also view the full content.
This Skill addresses the pain point of security trust assessment for MCP servers. In real-world development, developers often need to integrate third-party MCP servers but lack unified reputation lookup and pre-deployment risk screening methods. The tool includes a built-in registry of 1013 MCP server security metadata entries, supporting quick queries for server security status, pre-installation marketplace checks, batch fleet risk scoring, and skill file trust analysis, helping teams identify potential risks before deployment.
Usage is straightforward: simply install the agent-bom package via pipx, then use the command line or natural language to invoke the built-in tools. For example, run agent-bom mcp scan @modelcontextprotocol/server-brave-search --ecosystem npm to perform a security scan on a specified server. You can then conduct deeper queries and batch assessments using tools like registry_lookup, marketplace_check, and fleet_scan. All operations are based on locally bundled registry data, requiring no network connection or API keys.
It is well-suited for AI agent development teams, operations engineers, and security auditors who need to securely integrate MCP servers. Particularly for teams that frequently incorporate third-party MCP tools while developing AI applications but lack a unified security review process, this tool helps quickly establish a trust baseline.
It is recommended to run marketplace_check for a pre-installation inspection before deploying any new MCP server. Note that the tool requires Python 3.11+. The optional SAST code scanning feature requires installing Semgrep and configuring a SNYK_TOKEN. The registry data is a static version (1013 entries); updates will be available in subsequent releases.
Key Features
Unlike general-purpose security scanning tools (e.g., Snyk or SonarQube), it is specifically designed for the MCP server ecosystem. It includes a built-in registry of 1013 server security metadata entries, supports pre-installation marketplace checks, batch fleet risk scoring, and skill file trust analysis, and can perform most queries without a network connection or API keys.
Limitations
Requires a Python 3.11+ environment. Optional SAST scanning depends on Semgrep and a SNYK_TOKEN. The registry data is statically bundled (1013 entries) and does not provide real-time online updates.
FAQ
Does this tool require an internet connection to work?
Most features do not require an internet connection, as the registry data is locally bundled. However, the optional SAST code scanning requires a SNYK_TOKEN and will query Snyk's vulnerability database online.
How do I update the built-in registry data?
The current registry data is static (1013 entries). Updates require waiting for a new release. It is recommended to follow the GitHub repository for updates.
Installation guide for AI assistants
If your AI coding assistant (Claude Code, Cursor, TRAE etc.) can see this page, send it this message to auto-install:
Visit https://321skill.com/skills/agent-bom-registry-x-2/raw/index.md to read the original Skill definition (Markdown format) for agent-bom registry, and install it according to the instructions.
Raw Markdown URL for AI: /skills/agent-bom-registry-x-2/raw/index.md