check supports terminal output by default plus --format json for machine-readable pre-install verdicts.
report history and report diff support --format json for CI and automation.
report pipeline-events <scan-job.json> exports structured scan progress as JSONL for DAG/dashboard consumers.
report query "SELECT ..." runs read-only SQL against the local scan analytics store.
remediate is read-only by default and supports --format json as the machine-readable remediation contract.
remediate --apply patches supported package dependency manifests only after confirmation; --apply --open-pr creates a draft PR instead of pushing to the default branch.
agents --agent-mode emits a stable JSON envelope for assistant and automation callers. It defaults to JSON stdout, reports ok, exit_code, summary counts, confidence signals, truncation metadata, and the full scan payload under data.
Use agent-bom agents -f <format> -o <path> for SARIF, HTML, SBOM, and richer environment exports.
Use agent-bom agents -f sarif -o - when you need SARIF on stdout for piping.
where is available both as agent-bom where and agent-bom mcp where.
agent-bom verify and agent-bom verify agent-bom both self-verify the installed package.
The --self-scan flag is on the agents subcommand (not top-level). It walks the active Python environment via importlib.metadata.distributions() and emits a CVE report against agent-bom's own runtime so you can audit the tool with the tool.
See CLI Debug Guide for quiet/logging behavior, stdout vs file output, discovery triage, and package verification workflows.
Use the
Inaccurate Finding
template for false positives, false negatives, wrong severity/advisory mapping,
or misleading remediation. Include sanitized JSON/SARIF output and public
evidence; do not post secrets, private source code, private package names, or
customer data.
The repository includes a
sanitized inaccurate-finding report example
with a copy-paste-safe issue body.