Scan agent dependencies, packages, images, and filesystems for CVEs, provenance issues, and blast radius.
by Agent Bom73 installs
Data & analysis
agent-bom runtime
Correlate runtime activity with CVEs and analyze context graphs, vulnerability trends, and security posture.
What it does
Analyze agent context graphs for lateral movement, query vulnerability trends, posture history, and runtime events, and cross-reference runtime audit logs with CVE findings. It works from scan results already in memory and user-provided audit files, with optional ClickHouse persistence.
When to use it
- Lateral movement analysis from scan results
- Runtime audit log correlation with CVEs
- Thirty-day top-CVE trend queries
- Security posture and runtime event analysis
The skill document
agent-bom-runtime — AI Runtime Security Monitoring
Context graph analysis, runtime audit log correlation with CVE findings, and vulnerability analytics queries.
Install
pipx install agent-bom
Tools (3)
| Tool | Description |
|---|---|
context_graph | Agent context graph with lateral movement analysis |
analytics_query | Query vulnerability trends, posture history, and runtime events |
runtime_correlate | Cross-reference runtime audit logs with CVE findings |
Example Workflows
# Build context graph from scan results
context_graph()
# Correlate runtime audit with CVE data
runtime_correlate(audit_file="proxy-audit.jsonl")
# Query analytics
analytics_query(query="top_cves", days=30)
Privacy & Data Handling
Operates on scan results already in memory and user-provided audit log files. No automatic file discovery. No network calls unless you configure an optional ClickHouse endpoint for persistent analytics.
Verification
- Source: github.com/msaad00/agent-bom (Apache-2.0)
- 7,100+ tests with CodeQL + OpenSSF Scorecard
- No telemetry: Zero tracking, zero analytics
Questions people ask
- What data can it analyze?
- It operates on scan results already in memory and audit log files that you provide. It does not automatically discover files.
- Does it require network access?
- No network calls are made by default. Network access is used only if you configure an optional ClickHouse endpoint for persistent analytics.
- What runtime security tools are included?
- It provides `context_graph` for context and lateral-movement analysis, `analytics_query` for vulnerability and runtime analytics, and `runtime_correlate` for matching audit logs against CVE findings.
Related skills
Evaluate AI scan results against security frameworks, enforce policies, and export CycloneDX or SPDX SBOMs.
by Agent Bom73 installs
Check MCP servers and skill files for registry risk, provenance, trust, and code findings.
72 installs
Audit an AI agent locally, issue a certificate, verify peers, and establish signed trust handshakes.
67 installs
Add persistent local memory with trust-aware recall and enforcement against injection, leaks, and poisoning.
97 installs2 stars
Query monitoring, configuration, status, and logs from an authenticated 1Panel instance.
50 installs2 stars