agent-bom

Name: agent-bom Review
Item: agent-bom
Rating: 3.1
Author: Aaron Matthews

Skill Security Usable

Works inClaude Code

Usable Scanned — metadata only

AI supply chain attacks are emerging faster than teams can audit — this scanner maps the full blast radius of agent dependencies including MCP servers, conta…

Open security scanner for AI supply chain: agents, MCP, containers, cloud, GPU, and runtime with blast-radius analysis.

Scan MCP server dependencies for known vulnerabilities
Generate software bill of materials for AI agent stacks
Map blast radius of compromised components across deployments

29 starsApache-2.0 (commercial OK)FreeQuick setup

Usable rating — This tool is functional but has notable gaps. Review the evaluation notes below before deploying.

Why it matters

AI supply chain attacks are emerging faster than teams can audit — this scanner maps the full blast radius of agent dependencies including MCP servers, containers, and GPU runtimes, filling a critical gap in enterprise AI security posture.

Best for

Security teams and CISOs responsible for AI deployments who need to inventory and scan the full dependency tree of agent-based systems.

Works in

Claude Code Claude Cowork Claude Chat

Source

https://github.com/msaad00/agent-bom

By msaad00

How to Get It

Option 1: Claude Desktop App (Code Mode)Click the + button next to the prompt box → Plugins → Add plugin. Search and click Install. Skills work in Claude Code only.

Option 2: Paste into Claude CodeCopy the command below and paste it into your conversation. Claude will install it.

Command

claude plugins install msaad00/agent-bom

Tip: Paste this into a Claude Code conversation. Verify command matches your Claude Code version.

Auto-generated from the tool's public listing — not hands-on verified. Cross-check against the source repo's README before running.

First thing to try

After installing, paste this into Claude:

Help me scan MCP server dependencies for known vulnerabilities

CostFree

Trust Signals Auto-scanned

Stars29Contributors6Last updated2026-08-17LicenseApache-2.0 (OK for commercial use)Known CVEsNone foundSources: GitHub Advisory Database + OSV.dev · Scanned 2026-08-17 · scanner v1

Community Pulse Active

Discussed on Hacker News, Reddit

assisti agente secreto ontem e durante o filme várias pessoas saíram da sala do — Reddit · 284 pts
O Agente Secreto (2025) Que filme bom senhoras e senhores — Reddit · 132 pts
Oi gente tudo bom queria mostrar as artes do Gartic que agente fez (o mambo fez — Reddit · 9 pts

3 mentions across 1 sources

Reviewer notes

Auto-scanned review. These are observations, not a security certification.

catalog_hygiene stale-eval refresh: Scored from trust signals (evidence-eval-v1): 29 GitHub stars; 6 contributors; last commit 1d ago; license Apache-2.0.

Things to check

Recently discovered. Looks promising but has limited community feedback so far. We added it early so you can evaluate it before the crowd finds it.

How to evaluate tools before deploying →

Data shown here comes from public APIs and automated scanning. Reviewer notes reflect one person's experience. This is not a security certification or legal recommendation. Always evaluate tools according to your own organization's policies.

Evaluation Scores

Evaluation

Ease of Use

3/5

Versatility

2/5

Reliability

4/5

Security

4/5

Overall score3.15 / 5.00 UsableEvaluatedAug 2026

catalog_hygiene stale-eval refresh: Scored from trust signals (evidence-eval-v1): 29 GitHub stars; 6 contributors; last commit 1d ago; license Apache-2.0.

← Back to the Claude Observatory