agent-bom scan
Open-source security scanner for AI agent infrastructure
Install & Use
Copy this prompt and send it to your AI assistant (Claude / Cursor / TRAE / Codex / WorkBuddy etc.) to auto-install:
Help me install this AI Skill: agent-bom scan. It is used for: Open-source security scanner for AI agent infrastructure Full Skill content: https://321skill.com/skills/agent-bom-scan-x-3/raw/index.md Read that page and install it.
The prompt includes a link to the full Skill content. You can also view the full content.
This Skill addresses the pain point of security scanning for AI agent infrastructure. In practical development, engineers often need to simultaneously check container images for CVE vulnerabilities, detect secret leaks in MCP configuration files, assess supply chain risks in dependency packages, and audit security configurations of the Agent runtime. Typically, this requires multiple tools working in tandem, leading to inefficiency and potential oversights.
Usage is straightforward. After installing agent-bom, you can trigger scans using natural language instructions. For example, tell the AI "Scan this container image for security vulnerabilities" or "Check my MCP configuration for secret leaks." It will automatically parse image layers, dependency packages, and configuration files, query vulnerability databases such as OSV, NVD, EPSS, and KEV, and generate a comprehensive security report containing CVE lists, vulnerability severity scores, and remediation advice.
It is well-suited for DevOps engineers, backend developers, and security researchers who need to ensure the security of their AI Agents. This is particularly valuable for teams already using AI coding tools like Claude Desktop, Cursor, or VS Code Copilot and are concerned about API key exposure in MCP configurations or known vulnerabilities in third-party dependencies.
We recommend integrating this tool into your CI/CD pipeline to uniformly perform security scans on container images and dependencies for every build. Note that it primarily relies on public vulnerability databases, so coverage for 0-day vulnerabilities may be delayed. Additionally, scan results are stored locally only and are not automatically uploaded; reports must be manually exported.
Key Features
Unlike traditional container scanning tools such as Trivy and Grype, agent-bom is specifically designed for AI agent infrastructure. It features built-in scanning for MCP configuration paths of over 20 mainstream AI coding tools (e.g., Claude, Cursor, Windsurf, Cline) and can automatically detect hardcoded API keys and sensitive information without requiring additional configuration.
Limitations
Requires a Python 3.11+ environment. It operates on a local-first scanning principle, depends on the update timeliness of public vulnerability databases (OSV, NVD, etc.), and currently does not support a remote API online scanning mode.
FAQ
Does scanning require an API key?
No. Basic scanning requires zero API keys. Optional environment variables can improve rate limits for OSV/NVD queries, but the tool will not automatically discover or transmit credentials.
Which AI tool configuration files can it scan?
It supports MCP configurations for over 20 tools, including Claude Desktop, Claude Code, Cursor, Windsurf, Cline, VS Code Copilot, Codex CLI, Gemini CLI, Goose, Continue, Zed, Roo Code, Amazon Q, JetBrains AI, and GitHub Copilot CLI.
Installation guide for AI assistants
If your AI coding assistant (Claude Code, Cursor, TRAE etc.) can see this page, send it this message to auto-install:
Visit https://321skill.com/skills/agent-bom-scan-x-3/raw/index.md to read the original Skill definition (Markdown format) for agent-bom scan, and install it according to the instructions.
Raw Markdown URL for AI: /skills/agent-bom-scan-x-3/raw/index.md