io.github.koda-ai-studio/agent-bom

None of its 8 tools are described as changing anything. For 4 the reading was uncertain, so no mark is shown.

• scanon 17 other serversreads or searches

  “Run a full AI supply chain security scan and return an AI-BOM.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes

  23 inputs

  • repo_urlstring or null“Public git repository URL to clone and scan, e.g.”
  • config_pathstring or null“Local directory to scan — a project root or an MCP client config directory.”
  • no_discoverboolean“Disable ambient host MCP-client discovery.”
  • imagestring or null“Docker image to scan (e.g.”
  • sbom_pathstring or null“Path to existing CycloneDX or SPDX JSON SBOM file to ingest.”
  • packagestring or null“Direct package or MCP launch command to scan, e.g.”
  • ecosystemstring or null“Ecosystem of ``package`` when the spec does not name a launcher: 'npm', 'pypi', 'go', 'cargo', 'maven', 'nuget', 'rubygems', 'composer', 'swift', 'pub', 'hex',…”
  • enrichboolean“Enable NVD CVSS, EPSS probability, and CISA KEV enrichment.”
  • offlineboolean or null“true: use the local vulnerability DB only and skip registry, OSV, GHSA, and NVIDIA network lookups (requires a populated DB from `agent-bom db update`).”
  • scorecardboolean“Enrich packages with OpenSSF Scorecard scores (requires resolvable GitHub repos).”
  • transitiveboolean“Resolve transitive dependencies for npx/uvx packages.”
  • verify_integrityboolean“Verify package SHA-256/SRI hashes and SLSA provenance against registries.”
  • fail_severitystring or null“Return failure status if vulns at this severity or higher: critical, high, medium, low.”
  • warn_severitystring or null“Return warning status (gate_status=warn, exit 0) when vulns at this severity or higher exist.”
  • auto_update_dbboolean“Explicitly refresh the local vuln DB when older than the daily freshness target before scanning.”
  • db_sourcesstring or null“Comma-separated DB sources to sync before scanning (e.g.”
  • output_formatstring“Output format: 'json' (default), 'sarif', 'cyclonedx', 'spdx', 'junit', 'csv', or 'markdown'.”
  • policyobject or null“Policy object to evaluate alongside scan results, e.g.”
  • detailstring“JSON output only.”
  • result_idstring or null“result_id from a previous scan response.”
  • sectionstring or null“Section of a stored result to page, e.g.”
  • offsetinteger“Zero-based item offset into `section`.”
  • limitinteger“Maximum items per page of `section` (1-200).”
• checkon 33 other serversreads or searches

  “Check a specific package for known CVEs before installing.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes

  4 inputs, 1 required

  • packagestringrequired“Package name with optional version, e.g.”
  • ecosystemstring“Package ecosystem: 'npm', 'pypi', 'go', 'cargo', 'maven', 'nuget', 'rubygems', 'composer', 'swift', 'pub', 'hex', 'conda', 'deb', 'apk', or 'rpm'.”
  • versionstring or null“Optional package version when omitted from ``package`` (e.g.”
  • offlineboolean“Use only the local advisory database.”
• intel_lookupon 1 other serverreads or searches

  “Look up one advisory from the local threat-intel database.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes

  1 input, 1 required

  • advisory_idstringrequired“CVE, GHSA, or OSV advisory ID, e.g.”
• policy_checkon 6 other servers

  “Evaluate a security policy against current scan results.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes

  1 input, 1 required

  • policy_jsonstringrequired“JSON string containing policy rules, e.g.”
• generate_sbomon 2 other serversgenerates content

  “Generate a Software Bill of Materials (SBOM) for your AI agent setup.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes

  2 inputs

  • formatstring“SBOM format: 'cyclonedx' (CycloneDX 1.7) or 'spdx' (SPDX 3.0).”
  • config_pathstring or null“Path to MCP client config directory.”
• complianceon 1 other serverreads or searches

  “Return compliance posture with its source: the tenant's persisted evidence, or a labelled local scan.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes

  8 inputs

  • config_pathstring or null“Local scan only: MCP client config directory.”
  • imagestring or null“Local scan only: Docker image to scan, e.g.”
  • tenant_idstring“Tenant scope for persisted compliance.”
  • sourcestring“auto: persisted tenant evidence when it exists, else a labelled local scan.”
  • frameworkstring or null“Persisted only: add one framework's controls, e.g.”
  • controlstring or null“Persisted only: page the finding ids driving this control.”
  • limitinteger“Driving finding ids per page.”
  • cursorstring or null“driving_findings.next_cursor from the previous page.”
• remediateon 1 other servergenerates content

  “Generate a remediation plan for vulnerabilities in your AI agent setup.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes

  2 inputs

  • config_pathstring or null“Path to MCP client config directory.”
  • imagestring or null“Docker image to scan, e.g.”
• exposure_pathson 1 other serverreads or searches

  “Return the attack-path queue in the dashboard's order, with why each path ranks where it does.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes

  14 inputs

  • tenant_idstring“Tenant scope.”
  • scan_idstring or null“Optional historical scan ID.”
  • limitinteger“Maximum ranked exposure paths to return.”
  • viewstring“summary (default): rank, risk, KEV, evidence tier, endpoints, finding/credential ids.”
  • min_risknumber“Minimum composite path risk (0-100).”
  • min_severitystring or null“Worst on-path finding at least this severe.”
  • kevboolean or null“Only paths through a known-exploited finding (true) or none (false).”
  • has_credentialboolean or null“Only paths that do (true) or do not (false) expose a credential.”
  • source_typestring or null“Entrypoint entity type, e.g.”
  • target_idstring or null“Only paths ending at this graph node id.”
  • finding_idstring or null“CVE, advisory or finding node id on the path.”
  • credential_idstring or null“Credential name or node id exposed on the path.”
  • node_idstring or null“Any graph node the path passes through.”
  • cursorstring or null“pagination.next_cursor; keep the filters unchanged.”

Each quoted sentence is the first sentence of the publisher’s own description. The kind of tool and the “changes data” mark are our AI model’s reading of that description, not something we tested: two differently worded runs had to agree, otherwise no label is shown, and nobody has checked them by hand. A tool without the “changes data” mark is described as only reading, searching or calculating, or the two runs did not agree. No tool was called. Read the publisher’s full description before relying on it. “Publisher declares” lists the hints the server itself sends with the tool (MCP annotations: read-only, destructive, idempotent, open-world); they are the publisher's claims, not checked by us. Inputs are the parameters in the tool's own input schema: name, declared type, whether it is required, and the first sentence of its description. Read 2026-10-23.

The registry verifies a package once, when it is published, and does not re-check it. A difference below is about the listing, not a judgement of the publisher.