メニュー
Open security scanner for agentic infrastructure — agents, MCP, packages, blast radius, runtime, and trust across MCP servers, skills, packages, and agents in Cortex Code.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Analyze blast radius, attack paths, and threat landscape across your AI infrastructure. Use when: "blast radius", "threat intel", "risk score", "attack path", "lateral movement", "context graph", "who can reach what".
AI compliance and policy engine — evaluate scan results against OWASP, NIST, SOC 2, ISO 27001, CMMC, EU AI Act, AISVS v1.0, and related frameworks. Generate SBOMs and compliance reports. Use when: "compliance report", "NIST", "SOC 2", "ISO 27001", "OWASP", "EU AI Act", "AISVS", "generate SBOM", "policy check".
Discover AWS-hosted AI agent and MCP-relevant assets from the operator's environment, emit canonical agent-bom inventory JSON, and scan it without giving agent-bom long-lived cloud credentials. Use when a user asks to inventory AWS Bedrock, ECS, SageMaker, Lambda, EKS, Step Functions, EC2, or agentic AWS infrastructure as canonical inventory. Passing that inventory to agent-bom is optional and operator-chosen.
Discover Azure-hosted AI agent and MCP-relevant assets from the operator's environment, emit canonical agent-bom inventory JSON, and scan it without giving agent-bom long-lived Azure credentials. Use when a user asks to inventory Azure OpenAI, Container Apps, AKS, Functions, ML, or agentic Azure infrastructure as canonical inventory.
Discover GCP-hosted AI agent and MCP-relevant assets from the operator's environment, emit canonical agent-bom inventory JSON, and scan it without giving agent-bom long-lived GCP credentials. Use when a user asks to inventory Vertex AI, Cloud Run, Cloud Functions, GKE, or agentic GCP infrastructure as canonical inventory.
Discover AI agents, MCP servers, and configurations on this machine or environment. Use when: "find agents", "what's configured", "doctor", "what MCP servers", "show me what's installed", "mcp inventory".
| name | agent-bom |
| description | Open security scanner for agentic infrastructure — agents, MCP, packages, blast radius, runtime, and trust across MCP servers, skills, packages, and agents in Cortex Code. |
| tools | ["bash"] |
Scan your MCP servers, packages, and AI agent configurations for CVEs, credential exposure, and supply chain risks. Maps blast radius from vulnerable packages to the credentials and tools they can reach.
# Install via pip or pipx
pipx install agent-bom
# Or run directly with uvx (no install needed)
uvx agent-bom scan
agent-bom scan
Auto-discovers all configured MCP clients (Cortex Code, Claude Desktop, Cursor, etc.), resolves their server packages, and scans for CVEs.
agent-bom check <package>@<version> --ecosystem <npm|pypi|go|maven|cargo|nuget|gem>
agent-bom scan --enrich
# Then review the blast radius section in the output
agent-bom scan -f cyclonedx -o sbom.json
agent-bom scan -f spdx -o sbom.spdx.json
agent-bom scan --gpu-scan
agent-bom mcp server
agent-bom proxy "npx @modelcontextprotocol/server-filesystem /workspace" --policy policy.yml
When a user asks to install a new MCP server or package:
agent-bom check <package> --ecosystem <ecosystem>When a user asks for a security review:
agent-bom scan --enrichWhen compliance documentation is needed:
agent-bom scan -f cyclonedx -o sbom.jsonagent-bom scan --enrich --compliance for compliance framework mappingagent-bom check before adding new MCP servers to your mcp.json--enrich for full NVD/EPSS/KEV enrichment (slower but more complete)agent-bom scan -f sarif for CI/CD integration with GitHub Security tabsanitize_env_vars()