Find vulnerable software behind your AI agents—and trace the exposure evidence.
For AppSec and platform engineers responsible for AI agents and MCP servers: scan a repository, correlate its findings with agent and infrastructure context, and prioritize fixes using blast radius and reachability evidence. Open security scanner and self-hosted control plane for AI, MCP, and cloud infrastructure. Local scans need no account.
Quick start · Sample graph · Self-host · Product tour · Docs
Quick start
From the repository you want to inspect:
pip install agent-bom
agent-bom scan .Read the inventory, findings, coverage gaps, and remediation guidance in the terminal.
Save a report with agent-bom scan . -f sarif -o findings.sarif, then
upload it and gate CI.
Run agent-bom doctor if setup fails. See the first-run guide.
No project handy? Run agent-bom scan --demo --offline for a bundled sample.
Exit 1 is expected: the sample trips the security gate. A non-zero exit
can mean a security gate or incomplete assessment; inspect the report and coverage.
See the exit codes.
