agent-bom-registry

name: agent-bom-registrydescription: >-  MCP server security registry and trust assessment — look up servers in the 427+  server security metadata registry, run pre-install marketplace checks, batch  fleet risk scoring, assess skill file trust, and run SAST code scans. Use when  the user mentions MCP server trust, registry lookup, marketplace check, or  skill trust assessment.version: 0.75.10license: Apache-2.0compatibility: >-  Requires Python 3.11+. Install via pipx or pip. Optional: Semgrep for SAST  code scanning. No API keys or network access required (registry is bundled).metadata:   author: msaad00  homepage: https://github.com/msaad00/agent-bom  source: https://github.com/msaad00/agent-bom  pypi: https://pypi.org/project/agent-bom/  scorecard: https://securityscorecards.dev/viewer/?uri=github.com/msaad00/agent-bom  tests: 6040  install:     pipx: agent-bom    pip: agent-bom  openclaw:     requires:       bins: []      env: []      credentials: none    credential_policy: "Zero credentials required. Registry data is bundled locally. No network calls needed."    optional_env:       - name: SNYK_TOKEN        purpose: "Snyk vulnerability enrichment for code_scan (optional)"        required: false    optional_bins:       - semgrep    emoji: "\U0001F50D"    homepage: https://github.com/msaad00/agent-bom    source: https://github.com/msaad00/agent-bom    license: Apache-2.0    os:       - darwin      - linux      - windows    data_flow: "Purely local. Registry data (427+ MCP server metadata) is bundled in the package. Lookups are in-memory string matches. Skill trust analysis parses user-provided SKILL.md content passed as a string argument."    file_reads:       - "user-provided SKILL.md files (for skill_trust analysis)"    file_writes: []    network_endpoints:       - url: "https://api.snyk.io"        purpose: "Snyk vulnerability enrichment for code_scan (requires SNYK_TOKEN)"        auth: true    telemetry: false    persistence: false    privilege_escalation: false    always: false    autonomous_invocation: restricted

pipx install agent-bom
agent-bom registry-lookup brave-search
agent-bom marketplace-check @anthropic/server-filesystem

# Look up a server in the registry
registry_lookup(server_name="brave-search")

# Pre-install trust check
marketplace_check(package="@modelcontextprotocol/server-filesystem")

# Assess trust of a skill file
skill_trust(skill_content="<paste SKILL.md content>")

# Batch risk scoring
fleet_scan(servers=["brave-search", "github", "slack"])