agent-bom registry
MCP Server Security Registry and Trust Assessment Tool
Install & Use
Copy this prompt and send it to your AI assistant (Claude / Cursor / TRAE / Codex / WorkBuddy etc.) to auto-install:
Help me install this AI Skill: agent-bom registry. It is used for: MCP Server Security Registry and Trust Assessment Tool Full Skill content: https://321skill.com/skills/agent-bom-registry-x-7/raw/index.md Read that page and install it.
The prompt includes a link to the full Skill content. You can also view the full content.
This Skill addresses the pain points of MCP server security assessment and trust decision-making. In practical development, as the MCP ecosystem expands, developers face a large number of MCP servers but lack a unified reference for security metadata, making it difficult to determine which servers are trustworthy and which pose risks. This tool includes a built-in registry of 1013 MCP server security metadata entries, providing pre-installation marketplace checks, batch risk scoring, skill file trust assessment, and SAST code scanning to help you comprehensively evaluate server security before use.
Usage is straightforward. You simply need to install the agent-bom package via pipx, and then you can invoke 7 dedicated tools from the command line or within an AI conversation. For example, tell the AI "Look up the MCP server brave-search," and it will call registry_lookup to return security information from the registry; say "Pre-installation check for @modelcontextprotocol/server-filesystem," and it will execute marketplace_check for trust cross-validation. You can also batch scan server lists, analyze skill file trustworthiness, and even run Semgrep for code scanning. All operations can be performed via natural language instructions, requiring zero configuration to get started.
It is ideal for agent developers, operations engineers, and test engineers who need to assess MCP server security. This is especially true for teams building multi-agent systems that frequently integrate third-party MCP servers, or individual developers wishing to perform security audits on MCP servers before deployment. It requires zero credentials, bundles registry data locally, eliminates the need for network calls, works in offline environments, and is suitable for scenarios with strict data privacy requirements.
It is recommended to use this tool uniformly when introducing new MCP servers or conducting security audits. Note that it requires a Python 3.11+ environment. The optional Semgrep scan requires separate installation (pip install semgrep). Registry data is statically bundled; to update it, please reinstall the package. The optional SNYK_TOKEN is used for enhanced vulnerability detection, but note that the token must remain in the operator's environment and must not be printed or embedded in skill output.
Key Features
Unlike general MCP marketplaces or simple listings, the agent-bom registry comes pre-loaded with a registry of 1013 security metadata entries and supports offline use, whereas other tools typically require online API queries. It also provides batch risk scoring, skill file trust assessment, and SAST code scanning, covering the full lifecycle security assessment from pre-installation to post-deployment.
Limitations
Requires a Python 3.11+ environment. SAST code scanning depends on the optional Semgrep tool. Registry data is a statically bundled version; updates require reinstalling the package.
FAQ
How do I update the registry data?
The registry data is statically bundled within the package. To get the latest data, please upgrade the agent-bom package to the latest version (`pipx upgrade agent-bom`).
Does it require an internet connection to use?
No. The registry data is bundled locally. All lookups and assessments are performed in local memory, requiring no network calls. The optional SNYK_API vulnerability enhancement requires internet access but is a non-essential feature.
Installation guide for AI assistants
If your AI coding assistant (Claude Code, Cursor, TRAE etc.) can see this page, send it this message to auto-install:
Visit https://321skill.com/skills/agent-bom-registry-x-7/raw/index.md to read the original Skill definition (Markdown format) for agent-bom registry, and install it according to the instructions.
Raw Markdown URL for AI: /skills/agent-bom-registry-x-7/raw/index.md