koda-ai-studio/agent-bom

For AppSec teams and developers who run Claude Code, Cursor, Codex or any MCP
client: see which agents, MCP servers, tools and packages are installed, which
are vulnerable, and what each one can reach. Local scans need no account.
Quick start ·
Try in browser ·
Laptop → team → org ·
What you get ·
Product tour ·
Docs
## Quick start
From the repository you want to inspect, with uv installed:
bash
uvx agent-bom scan . --no-discover -f html -o agent-bom-report.html
Open agent-bom-report.html for inventory, findings and fix guidance. Run the
same scan again later and agent-bom prints what changed since the last one.
No MCP configuration in the project? Package findings still apply.
No project handy? Run uvx agent-bom scan --demo --offline for a bundled sample;
Exit 1 is expected there because the sample trips the security gate. A non-zero
exit can mean a security gate or incomplete assessment; inspect the report and
coverage (exit codes, what a scan does and
does not establish,
first-run guide).
## From laptop to team to org
| Where | Start with | You get |
| On your laptop | uvx agent-bom scan . · claude mcp add agent-bom -- uvx agent-bom mcp server | Findings with fixes, a delta on every rescan, and agent-bom as a tool inside your coding agent (MCP server, plugins) |
| In your team | uses: koda-ai-studio/agent-bom@v0 on pull requests and a weekly schedule: | A PR gate with a findings comment and SARIF in code scanning, plus a weekly rescan that catches new CVEs in unchanged code (GitHub Action) |
| Across your org | agent-bom up locally, then Docker Compose or the Helm chart from oci://ghcr.io/koda-ai-studio/charts/agent-bom | Retained scans, one graph of agents, MCP servers, packages and credentials, SSO and audit, in your own infrastructure (self-host) |
## Why an AI supply-chain BOM
Agents and MCP servers ship without an inventory. A CVE in an AI package, a
poisoned tool description or an over-scoped credential matters by what the
agent that loads it can reach. A package SBOM stops at packages; agent-bom
records the chain and keeps the evidence for every edge.
| 1. Inventory | 2. Correlate | 3. Act |
| Agents, MCP servers, tools, packages, models, credential references and cloud resources, read-only | One graph: agent → MCP server → tool → package → credential → data, each edge with its source | Fix, gate CI, block poisoned tool calls, rescan to verify |
Fictional sample estate. Dashed use, credential and access links are configured
or modeled, not observed at runtime; path analysis covers the collected snapshot only.
The AWS badge describes environment membership; these sample agents have no
recorded execution host or model endpoint.
Agent, hosting and model context.
Findings map to
OWASP LLM Top 10, OWASP Agentic Top 10, OWASP MCP Top 10, MITRE ATLAS, EU AI Act and NIST AI RMF;
control mappings are investigation context, not certification.
## What you get
Start with the workflow you need. An individual developer can scan, inspect
findings and verify fixes without a shared control plane or a compliance
workflow. Teams can add retained scans and shared inventory; organizations can
add identity, audit review and governance when needed. These are adoption paths,