agent-bom runtime

This Skill addresses the pain point of runtime security monitoring for AI systems. In real-world deployments, AI agent audit logs, context graphs, and CVE vulnerabilities are often scattered across different systems. Manual correlation and investigation are highly inefficient and prone to missing advanced threats like lateral movement. agent-bom runtime helps security teams quickly identify anomalous behavior and accelerate security response by automatically correlating runtime context graph analysis with audit logs and CVE discoveries.

Usage is straightforward. Simply install agent-bom via pipx, then instruct your AI assistant with commands like: "Analyze the current runtime context graph," "Correlate audit logs from the last 24 hours with CVEs," or "Query vulnerability trends." It will automatically invoke three tools—context_graph, runtime_correlate, and analytics_query—to analyze scan results and user-provided JSONL format audit logs in memory, requiring no API keys. Optionally, configuring a ClickHouse database can persist analysis results for long-term trend tracking.

It is well-suited for teams or individuals needing to ensure AI runtime security, especially operations and security engineers who have already deployed AI agents, microservices, or agent clusters. For scenarios requiring frequent auditing of AI system behavior, investigating potential security vulnerabilities, or performing compliance checks, this tool can significantly reduce the manual analysis workload.

We recommend integrating this tool into your CI/CD pipeline to automatically trigger runtime audits after each deployment. Note that it primarily operates on scan results in local memory and user-provided audit log files; it does not automatically discover or upload any data, ensuring privacy. However, sensitive information (such as environment variable names) within the analysis results should be properly anonymized.