agent-bom registry
MCP Server Security Registry and Trust Assessment Tool
Install & Use
Copy this prompt and send it to your AI assistant (Claude / Cursor / TRAE / Codex / WorkBuddy etc.) to auto-install:
Help me install this AI Skill: agent-bom registry. It is used for: MCP Server Security Registry and Trust Assessment Tool Full Skill content: https://321skill.com/skills/agent-bom-registry-x-6/raw/index.md Read that page and install it.
The prompt includes a link to the full Skill content. You can also view the full content.
This Skill addresses the pain point of security and trust assessment for MCP servers. In practical development, developers often need to confirm whether an MCP server they are about to install is trustworthy, has any known vulnerabilities, and is suitable for integration into their projects. The agent-bom-registry includes a built-in security metadata registry for 1013 MCP servers, enabling quick queries on server trust levels, risk scores, and compliance information to help teams make security decisions before integration.
Usage is straightforward: simply install agent-bom via pipx and execute MCP server security scans using natural language instructions. For example, tell the AI 'Scan the security information for @modelcontextprotocol/server-brave-search', and it will automatically invoke the registry_lookup tool to query the registry, returning metadata such as the server's security score, source, and license. Batch fleet scans are also supported, allowing risk assessment of multiple MCP servers at once.
It is well-suited for AI agent development teams and operations engineers who need to integrate MCP servers, especially those already using Claude or other AI Agent platforms and wishing to ensure all connected MCP tools undergo security review. For enterprises requiring regular audits of MCP server inventories, the fleet_scan feature can generate batch risk score reports.
It is recommended to perform a pre-installation market check with this tool before integrating any new MCP server. Note that it primarily relies on locally bundled registry data, enabling basic queries without network requests. However, the optional SAST code scanning (code_scan) requires Semgrep installation, and the optional Snyk vulnerability enhancement requires the SNYK_TOKEN environment variable.
Key Features
Unlike the official MCP security guidelines, agent-bom-registry provides executable, automated tools rather than documentation. Compared to general-purpose security scanning tools (e.g., Semgrep), it is specifically designed for MCP servers, featuring a built-in metadata registry for 1013 servers and supporting batch risk and trust scoring without manual rule configuration.
Limitations
Requires Python 3.11+; optional dependency on Semgrep for SAST scanning; optional SNYK_TOKEN for vulnerability enhancement. Registry data is locally bundled and may not reflect real-time updates for the latest MCP server information.
FAQ
Does this tool require an internet connection?
Core functionality does not require an internet connection, as the registry data is locally bundled. However, the optional Snyk vulnerability enhancement requires network access and SNYK_TOKEN.
How do I update the registry data?
Currently, registry data is bundled with version updates. It is recommended to regularly update the agent-bom package to obtain the latest metadata.
Installation guide for AI assistants
If your AI coding assistant (Claude Code, Cursor, TRAE etc.) can see this page, send it this message to auto-install:
Visit https://321skill.com/skills/agent-bom-registry-x-6/raw/index.md to read the original Skill definition (Markdown format) for agent-bom registry, and install it according to the instructions.
Raw Markdown URL for AI: /skills/agent-bom-registry-x-6/raw/index.md