agent-bom registry
MCP Server Security Registry and Trust Assessment Tool
Install & Use
Copy this prompt and send it to your AI assistant (Claude / Cursor / TRAE / Codex / WorkBuddy etc.) to auto-install:
Help me install this AI Skill: agent-bom registry. It is used for: MCP Server Security Registry and Trust Assessment Tool Full Skill content: https://321skill.com/skills/agent-bom-registry/raw/index.md Read that page and install it.
The prompt includes a link to the full Skill content. You can also view the full content.
This Skill addresses the pain point of security trust assessment for MCP servers. In practical development, teams often lack a quick means to verify server security metadata and assess risks when integrating third-party MCP servers, which can easily lead to the introduction of malicious or untrusted components. Agent BOM Registry comes preloaded with 1,013 entries of MCP server security metadata, supporting registry lookup, marketplace pre-check, batch risk scoring, skill file trust assessment, and SAST code scanning, making security audits actionable and repeatable.
Usage is straightforward: simply install the agent-bom package via pipx, and you can invoke multiple tools using natural language instructions. For example, tell your AI, 'Help me check the security information of the brave-search server,' and it will call registry_lookup for a registry query. Say, 'Perform a batch risk scan on all MCP servers in the current directory,' and it will trigger fleet_scan for batch scoring. It also supports marketplace_check for pre-installation trust verification, skill_scan/trust for analyzing skill files, and code_scan for CWE-mapped code scanning via Semgrep.
It is well-suited for development teams, operations engineers, and security auditors who need to manage MCP server security. This is especially true for teams that have integrated numerous MCP servers into their AI agents and require automated security assessments, as well as projects that need compliance reviews of MCP servers before deployment. Individual developers building personal AI assistants can also use it to quickly verify the trustworthiness of the servers they employ.
It is recommended to use marketplace_check for a pre-installation scan before adding any new MCP server to avoid direct installation into a production environment. Note that it primarily relies on a locally bundled registry of 1,013 entries and can function fully offline. For more comprehensive SAST scanning, installing Semgrep as an optional dependency is advised. Registry updates are obtained by upgrading the package via pip to fetch the latest entries.
Key Features
Unlike the official MCP marketplace, which provides only basic information, Agent BOM Registry includes 1,013 entries of security metadata, supports batch risk scoring, skill file trust assessment, and SAST code scanning, and runs entirely locally without requiring a network connection, making it suitable for offline or internal network environments.
Limitations
Requires Python 3.11+ environment. The registry data is currently fixed at 1,013 entries (updated via pip package upgrades). SAST scanning depends on the optional Semgrep tool.
FAQ
Does using this tool require an internet connection?
No. The registry data is bundled locally, and all queries are performed in local memory with zero network dependency. Only the code scanning (`code_scan`) feature requires an internet connection if the optional Snyk functionality is enabled.
How often is the registry data updated?
Registry data is updated with each pip package release. It is recommended to periodically run `pip install --upgrade agent-bom` to obtain the latest entries.
Installation guide for AI assistants
If your AI coding assistant (Claude Code, Cursor, TRAE etc.) can see this page, send it this message to auto-install:
Visit https://321skill.com/skills/agent-bom-registry/raw/index.md to read the original Skill definition (Markdown format) for agent-bom registry, and install it according to the instructions.
Raw Markdown URL for AI: /skills/agent-bom-registry/raw/index.md