agent-bom registry
MCP Server Security Registry and Trust Assessment Tool
Install & Use
Copy this prompt and send it to your AI assistant (Claude / Cursor / TRAE / Codex / WorkBuddy etc.) to auto-install:
Help me install this AI Skill: agent-bom registry. It is used for: MCP Server Security Registry and Trust Assessment Tool Full Skill content: https://321skill.com/skills/agent-bom-registry-x/raw/index.md Read that page and install it.
The prompt includes a link to the full Skill content. You can also view the full content.
This Skill addresses the pain point of evaluating the security and trustworthiness of MCP servers. In real-world development, teams often need to quickly assess an MCP server's security posture, known vulnerabilities, and trust level, but lack a unified source of metadata and batch inspection methods. The agent-bom-registry comes pre-loaded with 1,013 entries of MCP server security metadata, allowing you to perform queries without manual searches or reliance on online APIs.
Usage is straightforward: simply install the agent-bom package via pip or pipx, then invoke the built-in tools via the command line or your AI assistant. For example, run agent-bom mcp scan @modelcontextprotocol/server-brave-search --ecosystem npm to scan the security of a single server. You can also use interfaces like registry_lookup, marketplace_check, and fleet_scan for batch risk scoring and skill file trust assessment. All operations are based on the locally packaged registry and require no internet connection.
It's ideal for DevOps engineers, backend developers, and AI agent developers managing multiple MCP servers. Teams that have built AI Agent ecosystems and frequently integrate third-party MCP services can perform security checks before deployment to mitigate risks. It's also suitable for security auditors conducting batch compliance reviews of existing MCP assets.
We recommend using this tool for marketplace checks and trust assessments before introducing any new MCP server. Note that it primarily relies on local registry data and currently does not support automatic online updates, but you can obtain the latest metadata by upgrading the package version. Optional Semgrep integration provides SAST code scanning capabilities but is not required; core functionality works without any network or API keys.
Key Features
Unlike manually searching for scattered MCP security information, agent-bom-registry provides 1,013 pre-loaded server security metadata entries, supports batch fleet risk scoring and skill file trust analysis, and requires no network connection or API keys—ready to use out of the box.
Limitations
Requires Python 3.11+ environment; optional dependency on Semgrep for SAST scanning. Registry data is locally packaged and currently does not support real-time online updates or user-defined entry additions.
FAQ
How do I find security information for a specific MCP server?
Use the `registry_lookup` tool and pass the server name, e.g., `registry_lookup(server_name="brave-search")`.
Is an internet connection required to use this tool?
No. The registry data is packaged locally, and all queries are performed via in-memory matching, requiring no network calls.
Installation guide for AI assistants
If your AI coding assistant (Claude Code, Cursor, TRAE etc.) can see this page, send it this message to auto-install:
Visit https://321skill.com/skills/agent-bom-registry-x/raw/index.md to read the original Skill definition (Markdown format) for agent-bom registry, and install it according to the instructions.
Raw Markdown URL for AI: /skills/agent-bom-registry-x/raw/index.md