agent-bom registry
MCP Server Security Registry and Trust Assessment Tool
Install & Use
Copy this prompt and send it to your AI assistant (Claude / Cursor / TRAE / Codex / WorkBuddy etc.) to auto-install:
Help me install this AI Skill: agent-bom registry. It is used for: MCP Server Security Registry and Trust Assessment Tool Full Skill content: https://321skill.com/skills/agent-bom-registry-x-4/raw/index.md Read that page and install it.
The prompt includes a link to the full Skill content. You can also view the full content.
This Skill addresses the core pain points in MCP server security and trust assessment. In real-world development, developers need to integrate numerous third-party MCP servers but lack a quick way to evaluate their security, source reliability, and the presence of known vulnerabilities. There is no unified trust assessment mechanism or batch risk scanning method.
Usage is straightforward. After installation, multiple built-in tools can be invoked via natural language. For example, telling the AI "Query the security metadata for the brave-search server" triggers registry_lookup to return results from the 1013-entry local registry. Saying "Scan the list of MCP servers in the current project" executes fleet_scan for batch risk scoring. You can also directly run marketplace_check for pre-installation trust verification or invoke code_scan for Semgrep-based SAST code scanning.
It is ideal for AI application development teams, DevOps security engineers, and agent developers who need to integrate MCP servers. Teams that have already deployed multiple MCP services, require regular security audits, or need compliance checks before deployment can significantly improve their security assessment efficiency.
It is recommended to use marketplace_check for pre-inspection before installing any new MCP server and to periodically use fleet_scan to audit the entire inventory. Note that the code_scan feature requires optional installation of Semgrep, and network access is needed when using the SNYK_TOKEN for vulnerability enrichment. The registry data is locally bundled and cannot be updated in real-time with the latest server information; it is advised to use it in conjunction with official updates.
Key Features
Unlike standard MCP server directories (e.g., npm registry), it includes a built-in database of 1013 security metadata records and a trust assessment engine. It supports batch risk scoring, SAST code scanning, and skill file trust analysis, going beyond simply listing server names and versions.
Limitations
Requires Python 3.11+ environment. Code scanning requires optional installation of Semgrep. Registry data is a locally bundled package and cannot fetch the latest server security information in real-time.
FAQ
How do I install this tool?
Install using `pipx install agent-bom` or `pip install agent-bom`. No API keys or network access is required for installation (registry data is pre-bundled).
Does the code scan feature require additional configuration?
The `code_scan` tool requires optional installation of Semgrep. It is recommended to set the `SNYK_TOKEN` environment variable to obtain third-party vulnerability enrichment data; otherwise, only basic SAST scanning is performed.
Installation guide for AI assistants
If your AI coding assistant (Claude Code, Cursor, TRAE etc.) can see this page, send it this message to auto-install:
Visit https://321skill.com/skills/agent-bom-registry-x-4/raw/index.md to read the original Skill definition (Markdown format) for agent-bom registry, and install it according to the instructions.
Raw Markdown URL for AI: /skills/agent-bom-registry-x-4/raw/index.md