Agent Bom MCP Server

@mcp/server-fs

Scan AI/MCP dependencies, descriptor injection, risky tool inputs and authentication configuration.

37 1 tool GitHub npm PyPI

No known CVEs

Apache-2.0 license

Actively maintained

Last commit 0d ago

Works with most clients

Transport: stdio, http

1 tool · ~39 tok

Grade A · 0.0% of 200K ctx

MCPpedia last refreshed this data 10h ago

Edit this pageView history

Agent Bom MCP Server is an MCP server that scan AI/MCP dependencies, descriptor injection, risky tool inputs and authentication configuration. Its tool list has not been published yet over stdio and http, requires no API key, and scores 88/100 on MCPpedia's security, maintenance and efficiency rubric.

Security DevOps

Step 1

Install in your client

Config is the same across clients - only the file and path differ.

Supported in Claude Desktopstdio, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "agent-bom": {
      "args": [
        "agent-bom",
        "mcp",
        "server"
      ],
      "command": "uvx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-msaad00-agent-bom)](https://mcppedia.org/s/io-github-msaad00-agent-bom)

Read me

What Agent Bom MCP Server does

Scan AI/MCP dependencies, descriptor injection, risky tool inputs and authentication configuration.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked - your result helps other developers.

npx -y '@mcp/server-fs' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Loading README…

Scored, not listed

Why this score

Five weighted categories - click any category to see the underlying evidence.

Score breakdown

88/100across 5 weighted dimensions

How we score →

0255075100

−12

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked @mcp/server-fs against OSV.dev.

Inventory

Tools (1)

Click any tool to inspect its schema.

~39 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience - it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Agent Bom MCP Server safe to use?: Agent Bom MCP Server has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment. Licensed under Apache-2.0.
How do I install Agent Bom MCP Server?: Agent Bom MCP Server supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can Agent Bom MCP Server do?: Agent Bom MCP Server provides 1 tool: Trust. See the full tools list on the server page for descriptions and parameters.
What AI clients work with Agent Bom MCP Server?: Agent Bom MCP Server is compatible with claude-desktop, cursor, claude-code. It uses stdio and http transport.
Is Agent Bom MCP Server actively maintained?: Agent Bom MCP Server is actively maintained - last commit was 0 days ago. It has 37 GitHub stars.

Similar servers

Others in security / devops

View all →

Mcp Gitlab96

MCP server for using the GitLab API

2.1k 12

io.github.vmoranv/jshookmcp95

Search-first MCP server for JavaScript reverse engineering: 735 tools across 36 domains.

2.1k 2

io.github.zenml-io/mcp-zenml93

MCP server for discovering, reading, and changing ZenML resources with compact generic tools

49 17

io.github.CakeRepository/1password92

MCP server for 1Password service accounts — tools and resources for vaults and credentials

22 8

MCP Security Weekly

Get CVE alerts and security updates for Agent Bom MCP Server and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Quick start

From the repository you want to inspect, with uv installed:

uvx agent-bom scan . -f html -o agent-bom-report.html

Open agent-bom-report.html for inventory, findings and fix guidance. The scan stays inside this repository: packages, MCP configuration, secrets and personal data, skills and IaC; it does not read agent configuration elsewhere on the machine. Run the same scan again later and agent-bom prints what changed since the last one. No MCP configuration in the project? Package findings still apply. No project handy? Run uvx agent-bom scan --demo --offline for a bundled sample; Exit 1 is expected there because the sample trips the security gate. A non-zero exit can mean a security gate or incomplete assessment; inspect the report and coverage (exit codes, what a scan does and does not establish, first-run guide).

Recorded agent-bom CLI showing sample findings and remediation guidance; no fix executed

From laptop to team to org

Where

Start with

You get

On your laptop

uvx agent-bom scan . · claude mcp add agent-bom -- uvx agent-bom mcp server

Findings with fixes, a delta on every rescan, and agent-bom as a tool inside your coding agent (MCP server, plugins)

In your team

uses: koda-ai-studio/agent-bom@v0 on pull requests and a weekly schedule:

A PR gate with a findings comment and SARIF in code scanning, plus a weekly rescan that catches new CVEs in unchanged code (GitHub Action)

Across your org

`agent-

Frequently Asked Questions

Is Agent Bom MCP Server safe to use?

Agent Bom MCP Server has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment. Licensed under Apache-2.0.

How do I install Agent Bom MCP Server?

Agent Bom MCP Server supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What can Agent Bom MCP Server do?

Agent Bom MCP Server provides 1 tool: Trust. See the full tools list on the server page for descriptions and parameters.

What AI clients work with Agent Bom MCP Server?

Agent Bom MCP Server is compatible with claude-desktop, cursor, claude-code. It uses stdio and http transport.

Is Agent Bom MCP Server actively maintained?

Agent Bom MCP Server is actively maintained - last commit was 0 days ago. It has 37 GitHub stars.

AI supply-chain BOM: supported agents, MCP servers and AI packages, and what each one can reach.

For AppSec teams and developers who run Claude Code, Cursor, Codex or any MCP client: see which agents, MCP servers, tools and packages are installed, which are vulnerable, and what each one can reach. Local scans need no account.

Quick start · Try in browser · Laptop → team → org · What you get · Product tour · Docs

Quick start

From the repository you want to inspect, with uv installed:

uvx agent-bom scan . -f html -o agent-bom-report.html

From laptop to team to org

Where	Start with	You get
On your laptop	`uvx agent-bom scan .` · `claude mcp add agent-bom -- uvx agent-bom mcp server`	Findings with fixes, a delta on every rescan, and agent-bom as a tool inside your coding agent (MCP server, plugins)
In your team	`uses: koda-ai-studio/agent-bom@v0` on pull requests and a weekly `schedule:`	A PR gate with a findings comment and SARIF in code scanning, plus a weekly rescan that catches new CVEs in unchanged code (GitHub Action)
Across your org	`agent-

... View full README on GitHub