메뉴
Open security scanner for agentic infrastructure — agents, MCP, packages, blast radius, runtime, and trust across MCP servers, skills, packages, and agents in Cortex Code.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Analyze blast radius, attack paths, and threat landscape across your AI infrastructure. Use when: "blast radius", "threat intel", "risk score", "attack path", "lateral movement", "context graph", "who can reach what".
AI compliance and policy engine — evaluate scan results against OWASP, NIST, SOC 2, ISO 27001, CMMC, EU AI Act, AISVS v1.0, and related frameworks. Generate SBOMs and compliance reports. Use when: "compliance report", "NIST", "SOC 2", "ISO 27001", "OWASP", "EU AI Act", "AISVS", "generate SBOM", "policy check".
Discover AWS-hosted AI agent and MCP-relevant assets from the operator's environment, emit canonical agent-bom inventory JSON, and scan it without giving agent-bom long-lived cloud credentials. Use when a user asks to inventory AWS Bedrock, ECS, SageMaker, Lambda, EKS, Step Functions, EC2, or agentic AWS infrastructure as canonical inventory. Passing that inventory to agent-bom is optional and operator-chosen.
Discover Azure-hosted AI agent and MCP-relevant assets from the operator's environment, emit canonical agent-bom inventory JSON, and scan it without giving agent-bom long-lived Azure credentials. Use when a user asks to inventory Azure OpenAI, Container Apps, AKS, Functions, ML, or agentic Azure infrastructure as canonical inventory.
Discover GCP-hosted AI agent and MCP-relevant assets from the operator's environment, emit canonical agent-bom inventory JSON, and scan it without giving agent-bom long-lived GCP credentials. Use when a user asks to inventory Vertex AI, Cloud Run, Cloud Functions, GKE, or agentic GCP infrastructure as canonical inventory.
Discover AI agents, MCP servers, and configurations on this machine or environment. Use when: "find agents", "what's configured", "doctor", "what MCP servers", "show me what's installed", "mcp inventory".
| name | agent-bom |
| description | Open security scanner for agentic infrastructure — agents, MCP, packages, blast radius, runtime, and trust across MCP servers, skills, packages, and agents in Cortex Code. |
| tools | ["bash"] |
Scan your MCP servers, packages, and AI agent configurations for CVEs, credential exposure, and supply chain risks. Maps blast radius from vulnerable packages to the credentials and tools they can reach.
# Install via pip or pipx
pipx install agent-bom
# Or run directly with uvx (no install needed)
uvx agent-bom scan
agent-bom scan
Auto-discovers all configured MCP clients (Cortex Code, Claude Desktop, Cursor, etc.), resolves their server packages, and scans for CVEs.
agent-bom check <package>@<version> --ecosystem <npm|pypi|go|maven|cargo|nuget|gem>
agent-bom scan --enrich
# Then review the blast radius section in the output
agent-bom scan -f cyclonedx -o sbom.json
agent-bom scan -f spdx -o sbom.spdx.json
agent-bom scan --gpu-scan
agent-bom mcp server
agent-bom proxy "npx @modelcontextprotocol/server-filesystem /workspace" --policy policy.yml
When a user asks to install a new MCP server or package:
agent-bom check <package> --ecosystem <ecosystem>When a user asks for a security review:
agent-bom scan --enrichWhen compliance documentation is needed:
agent-bom scan -f cyclonedx -o sbom.jsonagent-bom scan --enrich --compliance for compliance framework mappingagent-bom check before adding new MCP servers to your mcp.json--enrich for full NVD/EPSS/KEV enrichment (slower but more complete)agent-bom scan -f sarif for CI/CD integration with GitHub Security tabsanitize_env_vars()