agent-bom runtime

This Skill addresses the lack of runtime security monitoring for AI Agents. In practice, developers and operators often struggle to track AI agent context interactions, correlate audit logs with known vulnerabilities, leading to undetected security risks. The tool helps users quickly identify abnormal behaviors like lateral movement and privilege abuse by building context graphs and correlating CVE discoveries.

Usage is straightforward: simply install agent-bom via pipx, then issue natural language commands to the AI. For example, saying "Build a context graph for the current agent" invokes the context_graph tool; after providing an audit log file, runtime_correlate automatically cross-references the CVE database; analytics_query supports querying vulnerability trends and runtime events by time range. All operations are performed in-memory, requiring no network calls.

It is ideal for teams or individuals needing to monitor AI Agent runtime security, especially operations engineers and agent developers who have deployed multiple AI agents and are concerned about lateral movement and privilege escalation risks. It is also highly practical for AI security auditing and compliance checks, significantly reducing the complexity of manual log analysis.

We recommend using this tool for baseline scanning before deploying AI agents to production. Note that it primarily relies on local audit log files (JSONL format), with optional ClickHouse for persistent analysis. It does not automatically discover or upload any data, fully protecting user privacy.