agent-bom registry
MCP Server Security Registry and Trust Assessment Tool
Install & Use
Copy this prompt and send it to your AI assistant (Claude / Cursor / TRAE / Codex / WorkBuddy etc.) to auto-install:
Help me install this AI Skill: agent-bom registry. It is used for: MCP Server Security Registry and Trust Assessment Tool Full Skill content: https://321skill.com/skills/agent-bom-registry-x-8/raw/index.md Read that page and install it.
The prompt includes a link to the full Skill content. You can also view the full content.
This Skill addresses the pain point of security trust assessment for MCP servers. In real-world development, developers frequently need to install and use third-party MCP servers, but lack unified means for querying security metadata and performing pre-installation risk checks, which can easily lead to the introduction of unknown vulnerabilities or malicious components. The agent-bom registry comes pre-loaded with 1,013 security metadata entries for MCP servers. It supports pre-installation marketplace checks, batch risk scoring, skill file trust analysis, and SAST code scanning, helping teams systematically assess risks before deployment.
Usage is straightforward. Simply install the agent-bom package via pipx, then invoke its 7 core tools using natural language instructions. For example, tell the AI "Look up the security information for the brave-search server," and it will execute a registry_lookup query. Saying "Check the installation trust for @modelcontextprotocol/server-filesystem" will trigger a marketplace_check for pre-installation cross-verification. You can subsequently use fleet_scan to batch scan your entire server inventory, skill_trust to analyze the trust level of SKILL.md files, or code_scan to run Semgrep for SAST code scanning.
It is particularly well-suited for teams or individuals managing MCP server ecosystems, especially those already integrated with multiple MCP services and requiring regular security and compliance audits, such as operations and development teams. Agent developers can also use it to evaluate whether third-party MCP servers targeted for integration are secure and reliable, avoiding data leaks or functional anomalies caused by depending on malicious or vulnerable servers.
It is recommended to consistently use marketplace_check for pre-installation verification before installing any new MCP server and to periodically run fleet_scan on all active servers to generate risk scores. Note that it primarily requires a Python 3.11+ environment. SAST scanning requires the optional installation of Semgrep. The registry data is a locally bundled version; to obtain the latest data, upgrade the package via pip.
Key Features
Unlike conventional static security scanning tools (e.g., Bandit), the agent-bom registry is specifically designed for the MCP server ecosystem. It features a built-in local registry with 1,013 security metadata entries for MCP servers, enabling queries without a network connection. It integrates skill file trust assessment, batch fleet risk scoring, and SAST code scanning, forming a complete security chain from pre-installation to continuous monitoring.
Limitations
Requires a Python 3.11+ runtime environment. The SAST scanning functionality depends on the optional tool Semgrep. The registry data is a locally bundled version; updates require manually upgrading the agent-bom package.
FAQ
Does using this tool require a network connection?
No. The registry data (1,013 MCP server security metadata entries) is bundled within the package, and queries are performed entirely locally. A network connection is only required when using the optional Snyk integration for vulnerability enrichment.
Which operating systems are supported?
It supports the three major mainstream platforms: macOS, Linux, and Windows. Installation is via pipx or pip.
Installation guide for AI assistants
If your AI coding assistant (Claude Code, Cursor, TRAE etc.) can see this page, send it this message to auto-install:
Visit https://321skill.com/skills/agent-bom-registry-x-8/raw/index.md to read the original Skill definition (Markdown format) for agent-bom registry, and install it according to the instructions.
Raw Markdown URL for AI: /skills/agent-bom-registry-x-8/raw/index.md