agent-bom-scan — AI Supply Chain Vulnerability Scanner

Checks packages for CVEs, scans container images natively, verifies package provenance via Sigstore, scans filesystems, and generates SBOMs.

Install

pipx install agent-bom
agent-bom agents             # discover agents and scan dependencies
agent-bom check langchain==0.1.0  # check a specific package with version
agent-bom image nginx:1.25   # scan container image (native)
agent-bom fs .               # scan filesystem packages
agent-bom sbom .             # generate SBOM
agent-bom verify agent-bom   # verify Sigstore provenance
agent-bom where              # show all discovery paths

As an MCP Server

{
  "mcpServers": {
    "agent-bom": {
      "command": "uvx",
      "args": ["agent-bom", "mcp"]
    }
  }
}

When to Use

• "check package" / "is this package safe"
• "scan image" / "scan container"
• "verify" / "check provenance"
• "is this safe" / "CVE lookup"
• "scan dependencies"
• "blast radius"
• "generate SBOM"

Tools (8)

Tool	Description
check	Check a package for CVEs (OSV, NVD, EPSS, KEV)
scan	Full discovery + vulnerability scan pipeline
blast_radius	Map CVE impact chain across agents, servers, credentials
remediate	Prioritized remediation plan for vulnerabilities
verify	Package integrity + SLSA provenance check
diff	Compare two scan reports (new/resolved/persistent)