# agent-bom

Scans a repo for vulnerable packages hiding behind your agent's MCP servers. Useful when you need to know what is actually exposed.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 35
- Author: koda-ai-studio
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/koda-ai-studio/agent-bom
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/agent-bom

## What it does

agent-bom runs locally against your project. It builds a dependency inventory, matches it against known advisories, reports coverage gaps and suggests fixes. Everything shows up in the terminal. Reports can be saved to SARIF and used to gate CI.

It ships as a set of skills for Claude and Codex. `checkup` returns one verdict plus the three fixes that matter, `affected` tells you whether a given CVE hits what was scanned, `activity` reads local session history for MCP usage and unused servers, and `audit-mcp` and `audit-skills` flag permissive settings. A separate `agent-bom-guard` plugin blocks malicious and typosquatted installs before Claude runs them.

You need `uvx` and an `NVD_API_KEY`; without the key the server as configured will not start. Local scans need no account, and both plugins run a pinned agent-bom release on your own machine without sending anything to a service.

## Requirements
- Needs: Python and uv (commands run via uvx)
- Environment variables: `NVD_API_KEY` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add agent-bom -e NVD_API_KEY=<NVD_API_KEY> -- uvx agent-bom
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from agent-bom <command>

### Codex

**Platform CLI**
```bash
codex mcp add agent-bom --env NVD_API_KEY=<NVD_API_KEY> -- uvx agent-bom
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from agent-bom <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "agent-bom": {
            "command": "uvx",
            "args": [
                "agent-bom"
            ],
            "env": {
                "NVD_API_KEY": "<NVD_API_KEY>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from agent-bom <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "agent-bom": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "agent-bom"
            ],
            "env": {
                "NVD_API_KEY": "<NVD_API_KEY>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from agent-bom <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e NVD_API_KEY=<NVD_API_KEY> agent-bom uvx agent-bom
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from agent-bom <command>

## When to use it
- find vulnerable dependencies before a release
- trace which agent pulls in a risky package
- check whether MCP server permissions are too broad
- produce an AI-BOM in CycloneDX or SPDX
- block a typosquatted install before it executes

## Example prompts
- Run `agent-bom scan .` and tell me what turned up
- Does this project fall under CVE-2025-29927?
- Build a CycloneDX AI-BOM for this repo

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md