Menü
Scan AI agents and MCP servers for CVEs, generate SBOMs, map blast radius, enforce security policies
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Basierend auf der SOC-Berufsklassifikation
Bloom Mission Discovery — find missions matched to your taste, submit content, and track rewards. Powered by Bloom Protocol.
DESCRIPTION of what this skill does. Include specific trigger keywords and scenarios. Use when: scenario1, scenario2, scenario3.
Find and complete paid tasks on the 0xWork decentralized marketplace (Base chain, USDC escrow). Use when: the agent wants to earn money/USDC by doing work, discover available tasks, claim a bounty, submit deliverables, check earnings or wallet balance, or set up as a 0xWork worker. Task categories: Writing, Research, Social, Creative, Code, Data. NOT for: posting tasks (use the website), managing the 0xWork platform, or frontend development.
HSM-backed secret management for AI agents — store, retrieve, rotate, and share secrets via the 1Claw vault without exposing them in context.
1Password UI tab for OpenClaw dashboard. Manage secrets, credential mappings, and auth state from the Control UI.
One-step Safe rebalancer using on-chain 31Third policies.
| name | agent-bom |
| description | Scan AI agents and MCP servers for CVEs, generate SBOMs, map blast radius, enforce security policies |
| version | 0.32.0 |
| metadata | {"openclaw":{"requires":{"bins":["agent-bom"],"optional_bins":["docker","grype"],"env":[]},"optional_env":[{"name":"NVD_API_KEY","purpose":"Increases NVD rate limit from 5 to 50 requests per 30 seconds — not required for any functionality","sent_only_to":"https://services.nvd.nist.gov","required":false}],"emoji":"🛡","homepage":"https://github.com/msaad00/agent-bom","source":"https://github.com/msaad00/agent-bom","pypi":"https://pypi.org/project/agent-bom/","license":"Apache-2.0","os":["darwin","linux"],"install":[{"kind":"pipx","package":"agent-bom","bins":["agent-bom"]},{"kind":"pip","package":"agent-bom","bins":["agent-bom"]}],"file_reads":["~/Library/Application Support/Claude/claude_desktop_config.json","~/.config/Claude/claude_desktop_config.json","~/.claude/settings.json","~/.claude.json","~/Library/Application Support/Cursor/User/globalStorage/cursor.mcp/mcp.json","~/.config/Cursor/User/globalStorage/cursor.mcp/mcp.json","~/.cursor/mcp.json","~/.windsurf/mcp.json","~/Library/Application Support/Windsurf/User/globalStorage/windsurf.mcp/mcp.json","~/Library/Application Support/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json","~/.config/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json","~/Library/Application Support/Code/User/globalStorage/rooveterinaryinc.roo-cline/settings/cline_mcp_settings.json","~/.config/Code/User/globalStorage/rooveterinaryinc.roo-cline/settings/cline_mcp_settings.json","~/Library/Application Support/Code/User/globalStorage/amazonwebservices.amazon-q-vscode/mcp.json","~/.config/Code/User/globalStorage/amazonwebservices.amazon-q-vscode/mcp.json","~/Library/Application Support/Code/User/mcp.json","~/.config/Code/User/mcp.json","~/.continue/config.json","~/.config/zed/settings.json","~/.openclaw/openclaw.json","~/.snowflake/cortex/mcp.json","~/.docker/mcp/registry.yaml","~/.docker/mcp/catalogs/docker-mcp.yaml",".mcp.json","mcp.json",".cursor/mcp.json",".vscode/mcp.json","docker-compose.yml","docker-compose.yaml","compose.yml","compose.yaml"],"file_reads_justification":"These are the standard config file locations for 13 MCP clients.\nEach file is a JSON/YAML config containing MCP server definitions.\nagent-bom reads them to discover which MCP servers are configured,\nthen extracts package names for CVE scanning. On any given system,\nonly 2-4 of these files typically exist — the rest are silently skipped.\nThe 31 paths break down as: 13 MCP clients × ~2 OS variants = ~23 global\npaths + 5 project-level configs + 4 Docker Compose filenames.\nNo directory traversal, no glob patterns, no recursive walks.\nUse --dry-run to see exactly which files exist on YOUR system.\n","file_writes":[],"network_endpoints":[{"url":"https://api.osv.dev/v1/querybatch","purpose":"CVE lookup by package name+version","auth":false},{"url":"https://services.nvd.nist.gov/rest/json/cves/2.0","purpose":"CVSS score enrichment","auth":"optional — NVD_API_KEY increases rate limit from 5 to 50 req/30s, not required"},{"url":"https://api.first.org/data/v1/epss","purpose":"Exploit probability scores","auth":false},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","purpose":"Known exploited vulnerability status","auth":false},{"url":"https://registry.npmjs.org","purpose":"npm package metadata","auth":false},{"url":"https://pypi.org/pypi","purpose":"PyPI package metadata","auth":false}],"sensitive_data_handling":{"config_files_contain_secrets":true,"what_is_extracted":"server names, commands, arguments, env var NAMES only","what_is_never_extracted":"env var VALUES, file contents beyond JSON structure, auth tokens, passwords","credential_name_detection":"pattern-match on key names (*KEY*, *TOKEN*, *SECRET*, *PASSWORD*, *AUTH*) — values never read","redaction":"all credential-like values shown as ***REDACTED*** in output","in_memory_only":true,"written_to_disk":false},"data_sent":"package names and versions only","data_not_sent":"file paths, config contents, env var values, hostnames, IP addresses","checksums":{"pypi_sha256":"auto-verified at install time via pip","sigstore_signed":true,"slsa_provenance":"GitHub Actions OIDC (see release.yml)","verify_command":"agent-bom verify","verify_command_manual":"cosign verify-blob dist/agent_bom-*.whl --bundle dist/agent_bom-*.whl.bundle --certificate-oidc-issuer https://token.actions.githubusercontent.com"},"telemetry":false,"persistence":false,"privilege_escalation":false}} |
agent-bom is a read-only security scanner for AI agent and MCP server configurations. It discovers MCP client configs on your system, extracts package dependencies, and queries public vulnerability databases for known CVEs. It then maps blast radius (which credentials and tools are exposed if a package is compromised), generates SBOMs, and evaluates security policies.
Key capabilities:
docker binary, optional)agent-bom operates within a strictly bounded scope. Every file path, network endpoint, and data element is enumerated below and in the manifest metadata above.
The following paths are the only files agent-bom reads. Each is a JSON/YAML MCP client config. If a file does not exist, it is silently skipped. No directory traversal, no glob patterns, no recursive walks.
| Client | macOS path | Linux path |
|---|---|---|
| Claude Desktop | ~/Library/Application Support/Claude/claude_desktop_config.json | ~/.config/Claude/claude_desktop_config.json |
| Claude Code | ~/.claude/settings.json, ~/.claude.json | same |
| Cursor | ~/Library/Application Support/Cursor/User/globalStorage/cursor.mcp/mcp.json, ~/.cursor/mcp.json | ~/.config/Cursor/User/globalStorage/cursor.mcp/mcp.json, ~/.cursor/mcp.json |
| Windsurf | ~/.windsurf/mcp.json, ~/Library/Application Support/Windsurf/User/globalStorage/windsurf.mcp/mcp.json | ~/.windsurf/mcp.json |
| Cline (VS Code) | ~/Library/Application Support/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json | ~/.config/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json |
| Roo Code | ~/Library/Application Support/Code/User/globalStorage/rooveterinaryinc.roo-cline/settings/cline_mcp_settings.json | ~/.config/Code/User/globalStorage/rooveterinaryinc.roo-cline/settings/cline_mcp_settings.json |
| Amazon Q | ~/Library/Application Support/Code/User/globalStorage/amazonwebservices.amazon-q-vscode/mcp.json | ~/.config/Code/User/globalStorage/amazonwebservices.amazon-q-vscode/mcp.json |
| VS Code Copilot | ~/Library/Application Support/Code/User/mcp.json | ~/.config/Code/User/mcp.json |
| Continue.dev | ~/.continue/config.json | same |
| Zed | ~/.config/zed/settings.json | same |
| OpenClaw | ~/.openclaw/openclaw.json | same |
| Cortex Code | ~/.snowflake/cortex/mcp.json | same |
| Docker MCP Toolkit | ~/.docker/mcp/registry.yaml, ~/.docker/mcp/catalogs/docker-mcp.yaml | same |
Project-level configs (current working directory only): .mcp.json, mcp.json, .cursor/mcp.json, .vscode/mcp.json
Docker Compose files (current working directory only): docker-compose.yml, docker-compose.yaml, compose.yml, compose.yaml
Total: 31 specific file paths. All enumerated in metadata.openclaw.file_reads above.
*KEY*, *TOKEN*, *SECRET*, *PASSWORD*, *CREDENTIAL*, *AUTH*PATH, HOME, LANG) are excluded/etc, no system services, no kernel parametersAll network calls are read-only GET/POST to public vulnerability databases.
Only package names and versions are sent. All enumerated in metadata.openclaw.network_endpoints above.
| API | URL | Purpose | Auth required |
|---|---|---|---|
| OSV.dev | https://api.osv.dev/v1/querybatch | CVE lookup by package | No |
| NVD | https://services.nvd.nist.gov/rest/json/cves/2.0 | CVSS scores | No (API key optional) |
| EPSS | https://api.first.org/data/v1/epss | Exploit probability | No |
| CISA KEV | https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json | Known exploited vulns | No |
| npm | https://registry.npmjs.org/{pkg}/{version} | Package metadata | No |
| PyPI | https://pypi.org/pypi/{pkg}/{version}/json | Package metadata | No |
No telemetry, analytics, or tracking. Zero network calls unless scanning for vulnerabilities.
Network calls can be completely disabled with --no-scan (inventory-only mode).
[Local config files] → read server name, command, args, env var NAMES
↓
[Package names+versions] → sent to OSV.dev, NVD, EPSS, KEV, npm, PyPI
↓
[CVE results] → returned to local process, written to stdout or --output file
express@4.17.1)Users can restrict or bypass auto-discovery entirely:
| Flag | Effect |
|---|---|
--dry-run | Shows exactly which files and APIs would be accessed, then exits without reading anything |
--inventory <file> | Scans only the agents/packages defined in a JSON inventory file — skips all config discovery |
--project <dir> | Scans only MCP configs in a specific project directory |
--config-dir <dir> | Reads MCP configs from a single custom directory only |
--no-skill | Disables skill/instruction file scanning |
--skill-only | Runs only skill scanning, skips all agent/package/CVE analysis |
--no-scan | Inventory-only mode — discovers configs but makes no network calls |
Recommended first run: agent-bom scan --dry-run to preview the access plan before any actual scanning.
agent-bom itself optionally uses:
NVD_API_KEY — higher NVD rate limits (optional, never logged or transmitted beyond NVD)This is declared in metadata.openclaw.optional_env above. No env vars are required.
pipx install agent-bom
pip install agent-bom
uv tool install agent-bom
agent-bom --version
# Should print: agent-bom 0.32.0
# One-command verification — checks RECORD hashes, PyPI digest, PEP 740 attestation
agent-bom verify
# JSON output for automation
agent-bom verify --json
This checks:
cosign verify-blob dist/agent_bom-*.whl --bundle dist/agent_bom-*.whl.bundleagent-bom scan --format json
Discovers all configured MCP clients on your system, extracts package dependencies, and queries OSV.dev for known CVEs. No API keys required.
agent-bom scan --enrich --format json
Adds CVSS v4 scores from NVD, exploit probability from EPSS, and CISA Known Exploited
Vulnerability status to each finding. Set NVD_API_KEY for higher NVD rate limits (optional).
agent-bom check <package-name>@<version> -e <ecosystem>
Example:
agent-bom check @modelcontextprotocol/server-filesystem@2025.1.14 -e npm
agent-bom scan --format cyclonedx --output sbom.json
Supported formats: cyclonedx (CycloneDX 1.6), spdx (SPDX 3.0), sarif (SARIF 2.1.0)
docker binary)agent-bom scan --image nginx:1.25 --format json
Uses Grype/Syft if available, otherwise falls back to Docker CLI for package extraction.
This workflow requires the docker binary to be installed.
agent-bom scan --policy policy.json --enrich
agent-bom scan --enrich --remediate remediation.md
abom user (USER directive in every Dockerfile)You can independently verify every claim in this manifest:
| What to verify | How |
|---|---|
| Installed binary integrity | agent-bom verify — checks RECORD file hashes, PyPI digest, PEP 740 attestation, metadata consistency |
| Source code | git clone https://github.com/msaad00/agent-bom && grep -r "requests|urllib|httpx" src/ — all network calls use httpx, fully auditable |
| Network endpoints | grep -n "osv.dev|nvd.nist|first.org|cisa.gov|npmjs.org|pypi.org" src/agent_bom/ — exhaustive list of all outbound URLs in source |
| File access | grep -rn "open(|Path(" src/agent_bom/discovery/ — all file reads happen in the discovery module only |
| Credential handling | grep -n "credential_names|SENSITIVE_PATTERNS|REDACTED" src/agent_bom/ — values are never stored |
| Signed release | cosign verify-blob dist/agent_bom-*.whl --bundle dist/agent_bom-*.whl.bundle --certificate-oidc-issuer https://token.actions.githubusercontent.com |
| CI test count | See GitHub Actions — every commit runs 1000+ tests including security scanning |
| OpenSSF Scorecard | Scorecard viewer |
| Dry-run audit | agent-bom scan --dry-run — shows every file, API, and data element that would be accessed, with a full data audit |
The following are actual code excerpts from the agent-bom source that enforce the claims above. These can be verified at the linked source files.
Credential names only — values never read (models.py:222-233):
@property
def credential_names(self) -> list[str]:
"""Return names of env vars that look like credentials."""
sensitive_patterns = [
"key", "token", "secret", "password", "credential",
"api_key", "apikey", "auth", "private",
"connection", "conn_str", "database_url", "db_url",
]
return [
k for k in self.env # self.env is dict of {name: value} but only KEYS are returned
if any(pat in k.lower() for pat in sensitive_patterns)
]
Config parsing extracts structure only (discovery/init.py:160-167):
def parse_mcp_config(config_data: dict, config_path: str) -> list[MCPServer]:
"""Parse MCP server definitions from a config file.
Supports multiple config formats:
- Standard: {"mcpServers": {"name": {"command": ..., "args": [...]}}}
- VS Code: {"servers": {"name": {"type": "stdio", "command": ...}}}
"""
# Only extracts: server name, command, args, env var keys
All file reads are enumerated — no dynamic paths (discovery/init.py:30-107):
CONFIG_LOCATIONS: dict[AgentType, dict[str, list[str]]] = {
AgentType.CLAUDE_DESKTOP: {
"Darwin": ["~/Library/Application Support/Claude/claude_desktop_config.json"],
"Linux": ["~/.config/Claude/claude_desktop_config.json"],
},
# ... 10 more clients, each with hardcoded paths
}
# No dynamic path construction, no user input in paths, no glob patterns
The simplest way to verify the installed binary matches the published source:
# One-command integrity + provenance check
agent-bom verify
# Preview what files and APIs would be accessed (no actual reads)
agent-bom scan --dry-run
agent-bom verify checks:
For maximum assurance, install from source instead of PyPI:
git clone https://github.com/msaad00/agent-bom && cd agent-bom
pip install -e .
agent-bom scan --dry-run
The --dry-run output includes a Data Audit section that shows:
| Feature | Required binary | Notes |
|---|---|---|
| Core scanning | agent-bom only | No external tools needed |
| Docker image scanning | docker | Optional — only when user passes --image |
| Enhanced image scanning | grype, syft | Optional — richer results if available |