agent-bom-local

Plugin agent-bom-local in koda-ai-studio/agent-bom. Commands read from the repo's manifest — today.

Skills (9)

• affected

  Answer "am I affected by this CVE?" with agent-bom - look up a CVE, GHSA or OSV advisory (including CVEs only NVD has published) and report which agents, MCP servers, images or packages carry it with the version to patch to, which distro packages are possibly affected, and what was scanned. Use when

• audit-mcp

  Audit MCP server configurations with agent-bom for risky setups - credentials written into config, unpinned launchers, remote servers without authentication or TLS, broad filesystem or shell access, vulnerable or typosquatted packages, and coding-agent settings that run tools with no prompts or no s

• audit-skills

  Audit Claude skills, plugins and agent instruction files (SKILL.md, CLAUDE.md, AGENTS.md, rules files) with agent-bom for prompt injection, credential exfiltration, remote code execution, dangerous tool grants and embedded secrets. Use when the user asks whether a skill or plugin is safe, before ins

• bom

  Generate an AI-BOM (CycloneDX or SPDX) with agent-bom for this machine's agents and MCP servers, a project, a container image, a repository, or an AWS, Azure or GCP account - agents, MCP servers, tools, models and packages with their relationships and known vulnerabilities. Use when the user asks fo

• check

  Check a package or MCP server with agent-bom before installing or adding it - known CVEs, malicious or typosquatted names, and the fixed version. Use when the user is about to add an MCP server, install a dependency, or asks whether a package is safe.

• checkup

  One-step security checkup of this machine's AI setup with agent-bom - what is risky in the configured agents and MCP servers, which packages carry CVEs or are malicious, and the three fixes that matter most. Use when the user asks to check, review or secure their AI or agent setup, or asks "is my se

• fix

  Build a prioritized remediation plan with agent-bom - which upgrades remove the most risk, in what order, and which findings have no fix yet. Use when the user asks how to fix agent-bom findings, what to upgrade first, or for a remediation plan.

• inventory

  List the AI agents, MCP clients and MCP servers configured on this machine or in a named project or directory with agent-bom - the servers each client launches, the tools they expose, the packages behind them and how they connect. Use when the user asks what MCP servers, agents or tools are configur

• scan

  Scan this machine's AI agents and MCP servers, a container image, an SBOM or a repository with agent-bom for CVEs, supply-chain risk and exposed credentials. Use when the user asks for an agent-bom scan, an MCP or agent security check, or an AI supply-chain audit. It does not read chat or session hi

MCP servers (2)

• agent-bom

  runs: python3 ${CLAUDE_PLUGIN_ROOT}/mcp_launcher.py

• agent-bom-audit

  runs: python3 ${CLAUDE_PLUGIN_ROOT}/mcp_launcher.py --profile audit

Similar plugins