agent-bom
Active·★ 35·Apache-2.0·Updated 2026-10-22
agent-bom is an end-to-end open security scanner for the AI supply chain. It performs CVE discovery, blast-radius analysis, and provides remediation guidance. It supports multiple entry points including agent scanning, container image scanning, IaC scanning, and a self-hosted enterprise deployment.
#ai-agents#ai-security#ai-supply-chain#aibom#blast-radius#cloud-security#compliance#container-security
01
Features
01End-to-end blast radius analysis from CVE to credential exposure
02Multi-entrypoint scanning: agents, images, IaC, packages, cloud
03Compliance export (FedRAMP, SOC2, NIST AI RMF, etc.) with tamper-evident evidence bundles
04Self-hosted enterprise deployment with Helm, Postgres, ClickHouse, and Snowflake backends
05Runtime MCP proxy and gateway for traffic enforcement and audit
02
Compatibility
CLI
Command Line Interface
Verified via docs
Docker
Docker Container
Verified via docs
Kubernetes
Kubernetes Helm
Verified via docs
GitHub Actions
GitHub Action
Verified via docs
MCP Server
MCP Server
Verified via docs
03
Quick start
1
$ pip install agent-bom
04
Use cases
↳CI/CD gating for AI supply chain security
↳Security team audit of AI agents and MCP servers
↳Self-hosted enterprise security scanning with fleet management
05
Alternatives
nobulex★ 40
The trust economy for autonomous AI agents. Credit scores for machines. Agents earn Trust Capital through verified behavior, gating what they are allowed to do. Autonomy earned, not granted.
attestix★ 846
Attestix - Attestation Infrastructure for AI Agents. DID-based agent identity, W3C Verifiable Credentials, EU AI Act compliance layer, delegation chains, and reputation scoring. 47 MCP tools across 9 modules.
bluerock★ 35
Runtime visibility for Python MCP servers. Captures tool calls, session lifecycle, module imports (SHA-256), and subprocess execution as structured NDJSON. No code changes. Apache 2.0
red-team-blue-team-agent-fabric★ 32
466 security tests for AI agent systems — MCP, A2A, x402/L402, decision governance, benchmark integrity, skill supply chain. AIUC-1 pre-cert, NIST AI 800-2 aligned, 5 DOIs. v4.3.0
claude-code-pentest★ 31
Automate the full pentest process with six Claude Code skills covering recon, exploit chains, and bug bounty report generation from any domain.
Sentinelgate★ 25
Access control for AI agents. MCP proxy + Policy Decision Point. CEL policies, RBAC, full audit trail. Any container, any sandbox.
Comments
Log in to leave a comment
No comments yet. Be the first!