agent-bom scan
Open-Source AI Infrastructure Security Scanner
Install & Use
Copy this prompt and send it to your AI assistant (Claude / Cursor / TRAE / Codex / WorkBuddy etc.) to auto-install:
Help me install this AI Skill: agent-bom scan. It is used for: Open-Source AI Infrastructure Security Scanner Full Skill content: https://321skill.com/skills/agent-bom-scan-x/raw/index.md Read that page and install it.
The prompt includes a link to the full Skill content. You can also view the full content.
This Skill addresses the security scanning needs for AI agent infrastructure (Agent, MCP, packages, container images, SBOM). In real-world development, engineers often need to check if dependency packages have known CVEs, if container images pose security risks, or if MCP tools are trustworthy, but they lack a unified, local-first scanning tool.
Usage is straightforward: simply install agent-bom via pip or pipx, then tell your AI 'scan this package for security vulnerabilities' or 'check this container image'. It will automatically parse dependencies, query vulnerability databases such as OSV, NVD, EPSS, and KEV, and output a scan report containing CVE IDs, severity levels, and remediation advice. All scanning is local-first, sending only public package names and CVE IDs.
It is ideal for teams or individuals needing to secure their AI agent infrastructure, especially developers already using AI coding assistants like MCP, Claude, or Cursor. DevOps engineers can integrate it into CI/CD pipelines, backend developers can quickly validate dependency security, and QA engineers can audit container images and SBOMs.
It is recommended to use this tool for security checks during project initialization or after each dependency update. Note that it primarily targets known vulnerabilities in software packages and container images, not runtime behavior analysis; scanning large container images may take significant time and requires network connectivity to vulnerability databases.
Key Features
Unlike Trivy, `agent-bom scan` is specifically designed for AI agent infrastructure, supporting scans of MCP tool configurations and Agent blast radius, and features a zero-credentials policy out-of-the-box, requiring no external API key configuration to run.
Limitations
Requires Python 3.11+; performance when scanning large container images is limited by network and disk I/O; depends on internet access to vulnerability databases like OSV and NVD, making it unusable in offline environments.
FAQ
Do I need to apply for an API key to use it?
No, core functionality has zero credential requirements, sending only public package names and CVE IDs to vulnerability databases.
What types of files does it support scanning?
It supports Python package dependencies, container images, SBOMs, MCP configuration files, filesystems, and trust assessments for agentic infrastructure.
Installation guide for AI assistants
If your AI coding assistant (Claude Code, Cursor, TRAE etc.) can see this page, send it this message to auto-install:
Visit https://321skill.com/skills/agent-bom-scan-x/raw/index.md to read the original Skill definition (Markdown format) for agent-bom scan, and install it according to the instructions.
Raw Markdown URL for AI: /skills/agent-bom-scan-x/raw/index.md