agent-bom scan
AI Agent Infrastructure Security Scanner
Install & Use
Copy this prompt and send it to your AI assistant (Claude / Cursor / TRAE / Codex / WorkBuddy etc.) to auto-install:
Help me install this AI Skill: agent-bom scan. It is used for: AI Agent Infrastructure Security Scanner Full Skill content: https://321skill.com/skills/agent-bom-scan-x-8/raw/index.md Read that page and install it.
The prompt includes a link to the full Skill content. You can also view the full content.
This Skill addresses the challenge of security scanning for AI agent infrastructure. In practical development, engineers often need to check Agents, MCP servers, container images, and dependency packages for known vulnerabilities (CVEs), but lack a unified, open-source tool that requires no external scanners to quickly perform local security assessments.
Usage is straightforward: simply install agent-bom via pip or pipx, then instruct the AI with prompts like "Check if this package is safe," "Scan this container image," or "Validate this MCP server configuration." It automatically pulls vulnerability database information from sources like OSV, NVD, and EPSS, conducts comprehensive security scans on packages, containers, file systems, and SBOMs, and returns risk levels and remediation advice.
It is well-suited for teams or individuals needing to secure AI agent infrastructure. Particularly for developers who have deployed multiple Agents, MCP servers, or containerized AI services, it enables rapid identification of security risks in code repositories and configuration files, helping prevent supply chain attacks and runtime threats.
It is recommended to integrate this tool into CI/CD pipelines for automated scanning with each build. Note that it primarily relies on a Python 3.11+ runtime environment. Basic operations require no API keys, but optional environment variables can be configured for higher rate limits on vulnerability database queries. All scans are performed locally by default, with only public package names and CVE IDs sent to external databases.
Key Features
Unlike traditional container scanners such as Trivy or Grype, agent-bom is specifically designed for AI agent infrastructure. It can scan MCP configuration files, configuration files for AI tools like Claude/Cursor, and assess trust scores and blast radius, going beyond just containers and packages.
Limitations
Requires Python 3.11+ environment; installation is only supported via pip/pipx and does not natively run on Java or Node.js. Basic scanning has no rate limits, but high-frequency queries require configuring optional API keys to increase database call quotas.
FAQ
Does scanning require an internet connection? Will it leak my code?
Scanning is local-first. Only public package names and CVE IDs are sent to databases like OSV and NVD; no code or configuration file contents are uploaded. Offline scanning relies solely on local cache, but vulnerability database queries require an internet connection.
What types of files are supported for scanning?
Supports scanning PyPI packages, container images, SBOMs, file systems, and MCP configuration files for various AI tools (Claude Desktop, Cursor, Cline, etc.), and can detect secret leaks and configuration security risks.
Installation guide for AI assistants
If your AI coding assistant (Claude Code, Cursor, TRAE etc.) can see this page, send it this message to auto-install:
Visit https://321skill.com/skills/agent-bom-scan-x-8/raw/index.md to read the original Skill definition (Markdown format) for agent-bom scan, and install it according to the instructions.
Raw Markdown URL for AI: /skills/agent-bom-scan-x-8/raw/index.md