Skip to content

Architecture Overview

For detailed architecture diagrams and module breakdown, see the full architecture doc.

For the data-model contract between native agent-bom objects and optional OCSF projection, see Canonical Model vs OCSF.

For the end-to-end intake story across direct scans, read-only integrations, pushed ingest, and imported artifacts, see Data Ingestion and Security.

For the operator model behind attack paths, reachability, runtime evidence, and large graph readability, see Security Graph Model.

For the shortest operator-facing explanation of inputs, engine, outputs, deployment models, and product surfaces, see How Agent-BOM Works.

For the governance map that ties Agent BOM manifests, runtime decisions, graph evidence, and human/agent surfaces together, see AI Governance Control Plane.

For the next-phase hosted product plan that maps UI actions to control-plane entities, routes, and rollout order, see Hosted Product Control-Plane Spec.

For the browser-to-API trust boundary and the current auth/session model, see UI, API, Auth, and Session Model.

Scanning pipeline

graph LR
    A[MCP Client Configs] --> B[Discovery]
    B --> C[Package Extraction]
    C --> D[CVE Lookup]
    D --> E[Blast Radius]
    E --> F[Compliance Mapping]
    F --> G[Output]

    D --> |OSV, NVD, EPSS| H[(Vuln DBs)]
    B --> |29 first-class clients| I[Config Files]

agent-bom is best read as an open security scanner and graph for AI supply chain and infrastructure: one model spanning agents, MCP, packages, cloud, GPU, runtime, and operator-owned control planes.

Key modules

Module Path Purpose
Discovery src/agent_bom/discovery/ MCP client config parsing
Enrichment src/agent_bom/enrichment.py CVE lookup (OSV, NVD, EPSS, KEV)
Blast Radius src/agent_bom/blast_radius.py Impact chain mapping
Context Graph src/agent_bom/context_graph.py Lateral movement analysis
Registry src/agent_bom/registry.py 427+ server security metadata
Compliance src/agent_bom/compliance/ 15 framework mappings plus AISVS benchmark evidence
Asset Tracker src/agent_bom/asset_tracker.py Persistent vuln tracking — first_seen, resolved, MTTR
Proxy src/agent_bom/proxy.py Runtime MCP interception
Protection src/agent_bom/runtime/ 7-detector anomaly engine
Enforcement src/agent_bom/enforcement.py Tool poisoning detection
Security src/agent_bom/security.py Path validation, credential redaction
MCP Server src/agent_bom/mcp_server.py 36-tool FastMCP server
API src/agent_bom/api/ REST API (FastAPI)
Output src/agent_bom/output/ JSON, SARIF, CycloneDX, SPDX, OCSF, HTML, Prometheus, Mermaid, SVG

Security boundaries

  • All scanning is local-first; outbound calls are limited to explicitly enabled enrichment, cloud/read-only discovery, push/export, or operator-configured integrations
  • Config file env var values are always redacted before output
  • Path validation restricts file access to user home directory
  • No telemetry, no analytics, no tracking