AI supply chain security scanner — CVE scanning, blast radius, policy enforcement, SBOM generation
Most cloud and infrastructure work still happens through a UI a human drives. Agent MCP server moves it into the conversation instead. AI supply chain security scanner — CVE scanning, blast radius, policy enforcement, SBOM generation.
The server publishes 14 tools. What each one is for:
Read — only discovery by default; runtime write decisions are separate and explicitRole — Start hereDevelopers — agent-bom scanAppSec — agent-bom scan . -f sarif -o findings.sarifOverview — FindingsInvestigation — RemediationTarget — Start hereEKS — Terraform moduleAir-gapped — Image bundle guideNeed — First actionSurface — Get itContainer — docker pull agentbom/agent-bom — Docker HubBecause this one is hosted, setup is mostly authentication — you point your client at the endpoint and approve access. Nothing runs on your machine, so there is no runtime to keep patched.
Among the cloud and infrastructure options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. Agent's toolset — Read, Role, Developers and 11 more — is a fair guide to whether it matches your workflow. It is maintained by msaad00; worth a glance at recent repository activity before you build anything load-bearing on it.
This entry was verified against Agent's own documentation before publication; SyncDev keeps the directory reviewed rather than auto-generated.
| Tool | What it does |
|---|---|
| Read | only discovery by default; runtime write decisions are separate and explicit. |
| Role | Start here |
| Developers | agent-bom scan . |
| AppSec | agent-bom scan . -f sarif -o findings.sarif |
| Overview | Findings |
| Investigation | Remediation |
| Target | Start here |
| EKS | [Terraform module](deploy/terraform/platform-eks) |
| Air-gapped | [Image bundle guide](site-docs/deployment/airgapped-image-bundle.md) |
| Need | First action |
| Surface | Get it |
| Container | docker pull agentbom/agent-bom — [Docker Hub](https://hub.docker.com/r/agentbom/agent-bom) |
| Kubernetes | helm install agent-bom oci://ghcr.io/msaad00/charts/agent-bom |
| SDKs | [Python](sdks/python) · [TypeScript](sdks/typescript) · [Go](sdks/go) |
{
"mcpServers": {
"agent-bom": {
"command": "uvx",
"args": ["agent-bom"]
}
}
}Add to claude_desktop_config.json, then restart Claude Desktop.
Manage your whole Supabase project in conversation — database, auth, storage, Edge Functions and branches.
Stop letting your assistant hallucinate n8n node parameters — this server hands it the real schemas, templates and validation.
AWS Labs' official server suite — current AWS docs, CDK guidance, cost analysis and service tools.
Cloud browsers for AI agents — automation sessions that run in Browserbase's fleet, not on your machine.
Workers, KV, R2 and D1 by conversation — Cloudflare's official remote servers for building and observability.
Dashboards, Prometheus and Loki queries, incidents and alerts — observability by conversation.