| description | Open security scanner for agentic infrastructure — agents, MCP, packages, blast radius, runtime, and trust for package CVEs (OSV, NVD, EPSS, KEV), container images, provenance, filesystems, and SBOMs. Use when: "check package", "scan image", "verify", "is this safe", "scan dependencies", "CVE lookup", "blast radius". |
| metadata | {"author":"msaad00","homepage":"https://github.com/msaad00/agent-bom","source":"https://github.com/msaad00/agent-bom","pypi":"https://pypi.org/project/agent-bom/","scorecard":"https://securityscorecards.dev/viewer/?uri=github.com/msaad00/agent-bom","tests":7239,"install":{"pipx":"agent-bom","pip":"agent-bom","docker":"ghcr.io/msaad00/agent-bom:0.96.3"},"openclaw":{"requires":{"bins":[],"env":[],"credentials":"none"},"credential_policy":"Zero credentials required. Optional env vars below increase rate limits. They are never auto-discovered, inferred, or transmitted.","optional_env":[],"optional_bins":["semgrep","kubectl"],"emoji":"🛡","homepage":"https://github.com/msaad00/agent-bom","source":"https://github.com/msaad00/agent-bom","license":"Apache-2.0","os":["darwin","linux","windows"],"credential_handling":"Env var values are NEVER extracted from config files. sanitize_env_vars() replaces all env values with ***REDACTED*** BEFORE any config data is processed or stored. Only structural data (server names, commands, URLs) passes through. Source: https://github.com/msaad00/agent-bom/blob/main/src/agent_bom/security.py#L159","data_flow":"All scanning is local-first. Only public package names and CVE IDs are sent to vulnerability databases (OSV, NVD, EPSS, GitHub Advisories). No credentials, config file contents, or scan results leave the machine.","file_reads":["~/Library/Application Support/Claude/claude_desktop_config.json","~/.config/Claude/claude_desktop_config.json","~/.claude/settings.json","~/.claude.json","~/.cursor/mcp.json","~/Library/Application Support/Cursor/User/globalStorage/cursor.mcp/mcp.json","~/.windsurf/mcp.json","~/Library/Application Support/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json","~/Library/Application Support/Code/User/mcp.json","~/.codex/config.toml","~/.gemini/settings.json","~/.config/goose/config.yaml","~/.continue/config.json","~/.config/zed/settings.json","~/Library/Application Support/Code/User/globalStorage/rooveterinaryinc.roo-cline/settings/cline_mcp_settings.json","~/Library/Application Support/Code/User/globalStorage/amazonwebservices.amazon-q-vscode/mcp.json","~/Library/Application Support/JetBrains/*/mcp.json","~/.config/github-copilot/intellij/mcp.json","~/.junie/mcp/mcp.json","~/.copilot/mcp-config.json","~/.tabnine/mcp_servers.json","~/.snowflake/cortex/mcp.json","~/.snowflake/cortex/settings.json","~/.snowflake/cortex/permissions.json","~/.snowflake/cortex/hooks.json","~/.snowflake/connections.toml","~/.snowflake/config.toml",".mcp.json",".vscode/mcp.json",".cursor/mcp.json","user-provided SBOM files (CycloneDX/SPDX JSON)"],"file_writes":[],"network_endpoints":[{"url":"https://api.osv.dev/v1","purpose":"OSV vulnerability database — batch CVE lookup for packages","auth":false},{"url":"https://services.nvd.nist.gov/rest/json/cves/2.0","purpose":"NVD CVSS v4 enrichment — optional API key increases rate limit","auth":false},{"url":"https://api.first.org/data/v1/epss","purpose":"EPSS exploit probability scores","auth":false},{"url":"https://api.github.com/advisories","purpose":"GitHub Security Advisories — supplemental CVE lookup","auth":false}],"telemetry":false,"persistence":false,"privilege_escalation":false,"always":false,"autonomous_invocation":"restricted"}} |
