What is agent-bom?
agent-bom is a MCP server by msaad00 that aI supply chain security scanner: discovers MCP clients, scans dependencies for CVEs, maps blast radius to credentials and tools, and generates SBOMs. It is listed under Security and has 32 GitHub stars.
| Type | Mcp server |
|---|---|
| Author | msaad00 |
| Repository | msaad00/agent-bom |
| Popularity | 32 GitHub stars |
| Category | Security |
| Security | Low risk (80/100) |
| Rank | #1,064 of 4,418 MCP servers; #49 in Security |
| License | Apache-2.0 |
| Last commit | 2026-10-18 |
| Stars this week | +1 |
| Runs | Locally and in the cloud |
| Language | Python |
| Platforms | macOS, Windows, Linux |
Is agent-bom safe to install?
agent-bom scores 80/100 on the MCPMods security check: Low risk. Things to review: sends your data to a cloud service. It passed 3 of 6 checks.
MCP server results come from listing signals: who publishes it, where your data goes and what it can do. The code itself is not scanned yet.
| Check | Result |
|---|---|
| Community-built server | Note |
| Sends your data to a cloud service | Review |
| Needs an API key or account login | Note |
| Read-only by description | Pass |
| No code execution | Pass |
| Source on GitHub | Pass |
How do I install agent-bom?
- Find the launch command. The README says how the server starts (npx, uvx, docker or a remote URL) and which API keys it needs.
https://github.com/msaad00/agent-bom
- Add it to Claude Code. Replace the part after -- with the command from the README. Remote servers use --transport http with a URL.
claude mcp add agent-bom -- <command from README> claude mcp add --transport http agent-bom <server-url>
- Check it connected. This lists your MCP servers and their status.
claude mcp list
Or ask Claude to set it up
Paste this into Claude Code and it installs agent-bom for you:
Add the "agent-bom" MCP server from https://github.com/msaad00/agent-bom to Claude Code. Read its README for the launch command and any API keys I need, run claude mcp add, then check that it connects.