agent-bom — Claude Code MCP server: what it does, how to install
Scans a repo for vulnerable packages hiding behind your agent's MCP servers. Useful when you need to know what is actually exposed.
claude mcp add agent-bom -e NVD_API_KEY=<NVD_API_KEY> -- uvx agent-bomWhat agent-bom does
agent-bom runs locally against your project. It builds a dependency inventory, matches it against known advisories, reports coverage gaps and suggests fixes. Everything shows up in the terminal. Reports can be saved to SARIF and used to gate CI.
It ships as a set of skills for Claude and Codex. checkup returns one verdict plus the three fixes that matter, affected tells you whether a given CVE hits what was scanned, activity reads local session history for MCP usage and unused servers, and audit-mcp and audit-skills flag permissive settings. A separate agent-bom-guard plugin blocks malicious and typosquatted installs before Claude runs them.
You need uvx and an NVD_API_KEY; without the key the server as configured will not start. Local scans need no account, and both plugins run a pinned agent-bom release on your own machine without sending anything to a service.
What it helps with
- find vulnerable dependencies before a release
- trace which agent pulls in a risky package
- check whether MCP server permissions are too broad
- produce an AI-BOM in CycloneDX or SPDX
- block a typosquatted install before it executes
Example prompts for the agent
- Run
agent-bom scan .and tell me what turned up - Does this project fall under CVE-2025-29927?
- Build a CycloneDX AI-BOM for this repo
How to install agent-bom
Platform CLI
claude mcp add agent-bom -e NVD_API_KEY=<NVD_API_KEY> -- uvx agent-bomReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from agent-bom <command>
Platform CLI
codex mcp add agent-bom --env NVD_API_KEY=<NVD_API_KEY> -- uvx agent-bomReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from agent-bom <command>
Config file
{
"mcpServers": {
"agent-bom": {
"command": "uvx",
"args": [
"agent-bom"
],
"env": {
"NVD_API_KEY": "<NVD_API_KEY>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from agent-bom <command>
Config file
{
"servers": {
"agent-bom": {
"type": "stdio",
"command": "uvx",
"args": [
"agent-bom"
],
"env": {
"NVD_API_KEY": "<NVD_API_KEY>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from agent-bom <command>
Platform CLI
gemini mcp add -e NVD_API_KEY=<NVD_API_KEY> agent-bom uvx agent-bomReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from agent-bom <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about agent-bom
How do I install agent-bom in Claude Code?
Add the MCP server with claude mcp add agent-bom -e NVD_API_KEY=<NVD_API_KEY> -- uvx agent-bom. The explicit-transport variant is claude mcp add --env NVD_API_KEY=<NVD_API_KEY> --transport stdio agent-bom -- uvx agent-bom.
What does agent-bom do?
It inventories project dependencies and MCP server settings, correlates findings with advisories and shows what an agent can reach through its chain. The bundled skills answer questions like whether a project is safe to ship, in the agent chat itself.
Do I need an account or cloud service?
Local scans work without an account. The Claude and Codex plugins run a pinned release on your machine and send nothing to an agent-bom service.
