agent-bom registry
MCP Server Security Registry and Trust Assessment Tool
Install & Use
Copy this prompt and send it to your AI assistant (Claude / Cursor / TRAE / Codex / WorkBuddy etc.) to auto-install:
Help me install this AI Skill: agent-bom registry. It is used for: MCP Server Security Registry and Trust Assessment Tool Full Skill content: https://321skill.com/skills/agent-bom-registry-x-3/raw/index.md Read that page and install it.
The prompt includes a link to the full Skill content. You can also view the full content.
This skill addresses the challenge of security trust assessment for MCP servers. In practical development, developers often need to integrate third-party MCP servers but lack visibility into their security posture, making it difficult to determine their trustworthiness and potential risks. The tool comes pre-loaded with 1013 records of MCP server security metadata, supporting rapid lookup and risk scoring.
Usage is straightforward: install the agent-bom package and invoke the corresponding tool via the command line. For example, execute agent-bom mcp scan @modelcontextprotocol/server-brave-search --ecosystem npm to scan the security of a specified MCP server. You can then use natural language instructions to query the registry, perform market pre-checks, batch-scan server inventories, assess skill file trustworthiness, and even run SAST code scans.
It is well-suited for teams or individuals who need to securely integrate MCP servers, particularly intelligent agent developers, operations engineers, and test engineers who already use numerous MCP tools and require bulk assessment of server risks. For operators of AI Agent platforms, this is also an essential compliance checking tool.
We recommend uniformly using this tool for trust assessment before integrating any new MCP server. Note that it primarily relies on locally bundled registry data and does not require network access, but optionally supports third-party vulnerability enrichment via a SNYK_TOKEN and SAST scanning via Semgrep. The registry data is continuously updated; we recommend regularly upgrading the package version.
Key Features
Unlike general-purpose security scanning tools such as `npm audit` or Snyk, `agent-bom registry` is specifically designed for the MCP server ecosystem. It comes pre-loaded with 1013 records of MCP server security metadata, supports batch risk scoring, skill file trust analysis, and Sigstore provenance verification, and can perform local queries without requiring a network connection.
Limitations
Requires a Python 3.11+ environment. Semgrep is an optional dependency for SAST scanning. The registry data is a locally bundled version; updates require upgrading the package.
FAQ
Does this tool require an API key?
No, the core functionality runs entirely locally, with registry data bundled within the package. Optionally, you can set the `SNYK_TOKEN` environment variable if third-party vulnerability enrichment is needed.
How do I update the registry data?
Upgrade the `agent-bom` package via pip/pipx to get the latest registry data, e.g., `pip install --upgrade agent-bom`.
Installation guide for AI assistants
If your AI coding assistant (Claude Code, Cursor, TRAE etc.) can see this page, send it this message to auto-install:
Visit https://321skill.com/skills/agent-bom-registry-x-3/raw/index.md to read the original Skill definition (Markdown format) for agent-bom registry, and install it according to the instructions.
Raw Markdown URL for AI: /skills/agent-bom-registry-x-3/raw/index.md