agent-bom scan
Open-Source Security Scanner for Agent Infrastructure
Install & Use
Copy this prompt and send it to your AI assistant (Claude / Cursor / TRAE / Codex / WorkBuddy etc.) to auto-install:
Help me install this AI Skill: agent-bom scan. It is used for: Open-Source Security Scanner for Agent Infrastructure Full Skill content: https://321skill.com/skills/agent-bom-scan-x-5/raw/index.md Read that page and install it.
The prompt includes a link to the full Skill content. You can also view the full content.
This Skill addresses security scanning for Agent infrastructure (such as MCP services, AI agents, container images, and dependency packages). In real-world development, teams often face pain points like fragmented security data sources, difficulties in assessing blast radius, and a lack of runtime trust—especially when AI agents need to automatically handle third-party packages or images, making it hard to quickly pinpoint security risks.
Usage is straightforward: simply install agent-bom via pip, after which you can use natural language commands to scan packages, container images, file systems, or query CVE databases. For example, tell the AI "Check this Python package for security vulnerabilities," and it will automatically pull data from sources like OSV, NVD, EPSS, and KEV, then generate a report with risk levels and remediation advice. It supports local-first scanning and can analyze container images without requiring an external scanner.
It is well-suited for teams or individuals who need to ensure the security of their AI agents, particularly those already using the MCP protocol, frequently integrating third-party dependencies, or needing to audit container image SBOMs—such as operations engineers, security engineers, and AI developers. For scenarios involving managing multiple agents or requiring compliance audits, this tool can significantly reduce the cost of security investigations.
It is recommended to use this tool uniformly for security pre-checks in CI/CD pipelines or before agent startup. Note that it primarily relies on a Python 3.11+ environment. Basic functionality does not require an API Key, but configuring environment variables (e.g., a GitHub token) can improve vulnerability query rates. Optional dependencies like semgrep and kubectl can extend the depth of security analysis.
Key Features
Unlike Trivy or Grype, it is specifically designed for Agent infrastructure, supporting MCP protocol scanning, blast radius analysis, and runtime trust assessment. It can simultaneously query multiple vulnerability sources like OSV, NVD, EPSS, and KEV, and can scan container images without requiring additional configuration of external scanners.
Limitations
Requires a Python 3.11+ runtime environment. Basic scanning does not require an API Key, but configuring environment variables is recommended to improve query rates for high-concurrency vulnerability lookups. Optional dependencies `semgrep` and `kubectl` are used to extend scanning capabilities.
FAQ
Does using this tool require an API Key?
Core functionality does not require an API Key at all; all scanning is local-first. However, to improve query rates for databases like OSV and NVD, you can optionally configure environment variables such as a GitHub Token.
Which operating systems are supported?
Supports macOS, Linux, and Windows. Container image scanning is directly integrated and does not require installing an additional Docker scanner.
Installation guide for AI assistants
If your AI coding assistant (Claude Code, Cursor, TRAE etc.) can see this page, send it this message to auto-install:
Visit https://321skill.com/skills/agent-bom-scan-x-5/raw/index.md to read the original Skill definition (Markdown format) for agent-bom scan, and install it according to the instructions.
Raw Markdown URL for AI: /skills/agent-bom-scan-x-5/raw/index.md