agent-bom scan
Open-source AI Agent Infrastructure Security Scanner
Install & Use
Copy this prompt and send it to your AI assistant (Claude / Cursor / TRAE / Codex / WorkBuddy etc.) to auto-install:
Help me install this AI Skill: agent-bom scan. It is used for: Open-source AI Agent Infrastructure Security Scanner Full Skill content: https://321skill.com/skills/agent-bom-scan-x-6/raw/index.md Read that page and install it.
The prompt includes a link to the full Skill content. You can also view the full content.
This Skill addresses the lack of security scanning tools for AI agent infrastructure. In practical development, engineers often need to check whether the packages, MCP tools, and container images their AI agents rely on contain known vulnerabilities, but they lack a unified, external-scanner-free tool to quickly perform CVE lookups, SBOM generation, and blast radius analysis.
Usage is straightforward: simply install agent-bom via pip or pipx, then trigger scans using natural language instructions like "Check this Python package for CVE vulnerabilities" or "Scan the container image for security issues." It automatically resolves dependencies, queries vulnerability databases such as OSV/NVD/EPSS/KEV, and outputs a risk report—all without requiring any API keys.
It is well-suited for teams or individuals who need to secure their AI agent infrastructure, especially DevOps engineers, QA engineers, and agent developers who already use AI coding assistants like Claude or Cursor and want to integrate security scanning into their daily workflow.
We recommend using this tool for security pre-checks whenever new dependencies are introduced or container images are deployed. Note that it is primarily designed for agentic infrastructure scenarios; for traditional web applications or non-agent use cases, we suggest complementing it with general-purpose scanners like Trivy.
Key Features
Unlike Trivy, agent-bom is purpose-built for AI agent infrastructure, offering native support for MCP configuration scanning, blast radius analysis, and runtime trust evaluation—all without requiring external scanners or API keys for container image and SBOM scanning.
Limitations
Requires Python 3.11+ and installation via pip or pipx. Basic operations do not require API keys, but optional environment variables can improve rate limits for vulnerability database queries.
FAQ
Are API keys required to use it?
No, basic scanning does not require any API keys. However, setting environment variables for OSV/NVD, etc., can improve query rate limits.
What types of assets does it support scanning?
It supports scanning Python packages, container images, filesystems, SBOMs, MCP configurations, agent runtime environments, and more.
Installation guide for AI assistants
If your AI coding assistant (Claude Code, Cursor, TRAE etc.) can see this page, send it this message to auto-install:
Visit https://321skill.com/skills/agent-bom-scan-x-6/raw/index.md to read the original Skill definition (Markdown format) for agent-bom scan, and install it according to the instructions.
Raw Markdown URL for AI: /skills/agent-bom-scan-x-6/raw/index.md