agent-bom scan
Open-source AI Agent Infrastructure Security Scanner
Install & Use
Copy this prompt and send it to your AI assistant (Claude / Cursor / TRAE / Codex / WorkBuddy etc.) to auto-install:
Help me install this AI Skill: agent-bom scan. It is used for: Open-source AI Agent Infrastructure Security Scanner Full Skill content: https://321skill.com/skills/agent-bom-scan-x-4/raw/index.md Read that page and install it.
The prompt includes a link to the full Skill content. You can also view the full content.
This Skill addresses the pain points of security scanning for AI agent infrastructure. In practical development, developers often need to ensure that MCP configurations, container images, dependency packages, SBOMs, and file systems are free from known vulnerabilities, but manual checks are time-consuming and prone to oversight. agent-bom scan can automatically scan these components, covering multiple vulnerability databases such as CVE, OSV, NVD, EPSS, and KEV, helping teams identify security risks before deployment.
Usage is straightforward: after installing via pip, simply give natural language instructions to your AI assistant like "Check if this package is safe," "Scan the current image," or "Verify the MCP configuration." It automatically reads local MCP configuration files (e.g., for Claude Desktop, Cursor, VS Code Copilot) and queries public vulnerability databases for comparison. All scanning is local-first, requiring no additional API keys, and works offline after the initial network download of the database.
It is well-suited for teams or individuals needing to secure AI agent infrastructure, especially developers using AI coding agents like Claude, Cursor, or Copilot that rely on MCP tool extensions. DevOps and QA engineers can integrate this tool into CI/CD pipelines to automatically scan container images and dependencies; agent developers can also use it to inspect the security of runtime environments and third-party components.
It is recommended to use this tool uniformly for security scanning when deploying new projects or updating dependencies. Note that it primarily detects known vulnerabilities and configuration risks, and cannot cover 0-day vulnerabilities or security issues in custom code logic. Additionally, while it reads local MCP configuration files, it does not upload any sensitive information—all queries only send package names and CVE IDs to public databases, ensuring user privacy.
Key Features
Unlike traditional container scanners like Trivy, `agent-bom scan` is specifically designed for security scanning of AI agent infrastructure (e.g., MCP configurations, Agent runtime). It can natively analyze container images without requiring an external scanner and supports reading MCP configuration files for over a dozen AI tools, including Claude, Cursor, and Copilot.
Limitations
Requires Python 3.11+; initial use requires an internet connection to download the vulnerability database; scanning large container images may be slow; depends on pipx or pip installation and does not support native Go or Rust packaging.
FAQ
Are API keys required?
No, basic operations require zero credentials. Optional environment variables are only used to increase API rate limits and are not automatically discovered or transmitted.
Which container image formats are supported?
Supports Docker images and OCI standard formats, with no additional scanner installation required.
Installation guide for AI assistants
If your AI coding assistant (Claude Code, Cursor, TRAE etc.) can see this page, send it this message to auto-install:
Visit https://321skill.com/skills/agent-bom-scan-x-4/raw/index.md to read the original Skill definition (Markdown format) for agent-bom scan, and install it according to the instructions.
Raw Markdown URL for AI: /skills/agent-bom-scan-x-4/raw/index.md