MCP.Market

agent-bom MCP server

online · 100% uptime
by koda-ai-studio·io.github.koda-ai-studio/agent-bom·v0.113.1·35 stars
No reviews yet

AI supply-chain BOM: agents, MCP servers, packages and recorded reach. Scan and investigate via MCP.

B74/100grade B
Write a reviewRun it
What users say
No reviews yet
Be the first
Safety scan
B74/100

not scanned yet

Adoption
Growing

35 stars750 downloads/wk

Reviews

Write one

Nobody has reviewed agent-bom yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

agent-bom tools

Tool list not cached yet. `describe` through the gateway fetches it live.

Not scanned yet. New listings are scanned within a day or two of arriving.

How agent-bom compares

Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
74/100
higher than 43% of 4,460 AI and agents servers
Response time
116 ms
faster than 83% of 2,331 AI and agents servers
GitHub stars
35
more than 91% of 2,711 AI and agents servers
Downloads a week
750
more than 91% of 1,538 AI and agents servers with a package

Release history: 5 versions in the registry since 2026-10-22, latest 2026-11-04, typically one every 5 days.

Install agent-bom in Claude Code, Cursor or VS Code

claude mcp add --transport http agent-bom https://agent-bom-mcp.up.railway.app/mcp
Add to Cursor

What the publisher says

From the agent-bom repository's README, as published. We do not edit it. Read it on GitHub

<!-- mcp-name: io.github.koda-ai-studio/agent-bom -->

Find vulnerable software behind your AI agents—and trace the exposure evidence.

Open security scanner and self-hosted control plane for AI, MCP, and cloud infrastructure. For AppSec and platform engineers responsible for AI agents and MCP servers: scan a repository, correlate its findings with agent and infrastructure context, and prioritize fixes by blast radius and reachability evidence. Local scans need no account.

Quick start · Claude Code and Codex · Sample graph · Self-host · Product tour · Docs

Quick start

From the repository you want to inspect:

pip install agent-bom
agent-bom scan .

Read the inventory, findings, coverage gaps, and remediation guidance in the terminal. Save a report with agent-bom scan . -f sarif -o findings.sarif, then upload it and gate CI. Run agent-bom doctor if setup fails. See the first-run guide.

No project handy? Run agent-bom scan --demo --offline for a bundled sample. Exit 1 is expected: the sample trips the security gate. A non-zero exit can mean a security gate or incomplete assessment; inspect the report and coverage. See the exit codes.

The recording uses labeled sample data and bundled advisories. Credential references are names, not secret values. Recorded relationships do not prove exploitation or successful data access.

Use it from Claude Code or Codex

Ask your coding agent instead of reading a report. In Claude Code:

/plugin marketplace add koda-ai-studio/agent-bom
/plugin install agent-bom@agent-bom

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

agent-bom: common questions

Is agent-bom MCP server safe?
Mostly: it is graded B (74/100). Read the agent-bom safety report
How do I install agent-bom?
It runs remotely at agent-bom-mcp.up.railway.app. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
Does agent-bom need an API key?
Yes. The registry entry asks for NVD_API_KEY, Authorization.
Is agent-bom maintained?
The last commit was 10 days ago (2026-10-25). The latest release is v0.113.1.
Is agent-bom up?
100% of our last 1 checks got an answer. We check remote servers about four times a day.
What can I use instead of agent-bom?
Servers from other publishers that do the same job: Agent Security Scanner MCP server, Orcareplay MCP server and three.ws Provenance MCP server.
How does agent-bom compare with other AI and agents MCP servers?
safety score 74/100 (higher than 43% of 4,460 AI and agents servers); response time 116 ms (faster than 83% of 2,331 AI and agents servers); github stars 35 (more than 91% of 2,711 AI and agents servers). Full comparison.

Alternatives to agent-bom

Same job from other publishers: the closest match first, then the best rated.

  • Agent Security Scanner
    Security layer for AI agents: blocks prompt injection, detects fake packages, scans vulnerabilities.
    C
  • Orcareplay
    Read, replay and fork recorded coding-agent runs.
    A
  • three.ws Provenance
    Append-only, signed, on-chain-verifiable agent action log — record and audit what agents did.
    More from nirholas →
    B
  • Skillsmith
    Share agent skills across your team, scan them for risk, and track what's actually used.
    B
  • Claude Prompts
    Reusable prompt templates, multi-step workflow chains, and quality gates for any MCP client.
    A