compliance
Get OWASP LLM Top 10 / OWASP MCP Top 10 / MITRE ATLAS / NIST AI RMF compliance posture.
Scans local MCP configurations, maps findings to 47 security controls
across four AI security frameworks, and returns per-control
pass/warning/fail status with an overall compliance score.
Args:
config_path: Path to a specific MCP config directory.
If not provided, auto-discovers all local agent configs.
image: Docker image reference to scan (e.g. "nginx:1.25").
Returns:
JSON with overall_score (0-100), overall_status (pass/warning/fail),
and per-control details for OWASP LLM Top 10 (10 controls),
OWASP MCP Top 10 (10 controls), MITRE ATLAS (13 techniques),
and NIST AI RMF (14 subcategories).
remediate
Generate a remediation plan for vulnerabilities in your AI agent setup.
Scans for vulnerabilities, then generates actionable fix commands for
each affected package (npm install, pip install), credential scope
reduction guidance, and reports on unfixable vulnerabilities.
Args:
config_path: Path to a specific MCP config directory.
If not provided, auto-discovers all local agent configs.
image: Docker image reference to scan (e.g. "nginx:1.25").
Returns:
JSON with package_fixes (upgrade commands by ecosystem),
credential_fixes (scope reduction steps), and unfixable items.
skill_scan
Scan skill and instruction files for trust, findings, and provenance.
Discovers supported files such as `CLAUDE.md`, `AGENTS.md`,
`.cursorrules`, and `skills/*.md`, then parses referenced packages,
MCP servers, credential env vars, audit findings, and trust verdicts.
skill_verify
Verify Sigstore provenance for skill and instruction files.
skill_trust
Assess the trust level of a SKILL.md file using ClawHub-style categories.
Parses a SKILL.md file, runs security audit checks, then evaluates
trust across 5 categories: Purpose & Capability, Instruction Scope,
Install Mechanism, Credentials, and Persistence & Privilege.
Returns an overall verdict (benign/suspicious/malicious) with
confidence level and actionable recommendations.
Args:
skill_path: Path to a SKILL.md file (or any skill/instruction file).
Returns:
JSON with verdict, confidence, per-category assessments, and
recommendations.
verify
Verify package integrity and SLSA provenance against registries.
Checks SHA-256/SRI hashes against npm/PyPI registries and looks up
SLSA build provenance attestations to confirm the package was built
from its claimed source repository.
Returns:
JSON with integrity verification (hash match, expected vs actual)
and provenance status (SLSA level, source repo, build trigger).
where
Show all MCP discovery paths and which config files exist.
Lists every known MCP client config path per platform, indicating
which files are present on the current system. Useful for debugging
discovery issues or understanding where MCP configs live.
Returns:
JSON with per-client config paths, existence status, and platform.
inventory
List all discovered MCP configurations and servers without CVE scanning.
Performs fast discovery and package extraction only — no vulnerability
scanning. Use this for a quick inventory of configs, servers, and packages.
Returns:
JSON with discovered agents, their MCP servers, packages, and
transport types.
tool_risk_assessment
Score live-introspected MCP tool capabilities and server risk.
Uses runtime `tools/list` data to classify tool capabilities
(READ/WRITE/EXECUTE/NETWORK/etc.) and compute a per-server risk profile.
Returns:
JSON with per-server tool profiles, capability counts, dangerous
combinations, and risk justification.
diff
Compare a fresh scan against a baseline to find new and resolved vulns.
Runs a new scan, then diffs it against the provided baseline (or the
latest saved report). Shows new vulnerabilities, resolved ones, and
changes in the package inventory.
Returns:
JSON with new findings, resolved findings, new/removed packages,
and a human-readable summary.
marketplace_check
Pre-install trust check for an MCP server package.
Queries the package registry (npm or PyPI) for metadata and
cross-references against the agent-bom MCP threat intelligence registry.
Returns trust signals including download count, CVE status, and
registry verification.
Args:
package: Package name to check.
ecosystem: 'npm' or 'pypi'. Defaults to 'npm'.
Returns:
JSON with name, version, ecosystem, cve_count, download_count,
registry_verified, and trust_signals.
code_scan
Run SAST (Static Application Security Testing) on source code via Semgrep.
Scans for security flaws: SQL injection, XSS, command injection,
hardcoded credentials, insecure deserialization, path traversal, etc.
Returns findings with CWE classifications and severity levels.
Requires ``semgrep`` on PATH (``pip install semgrep``).
context_graph
Build an agent context graph with lateral movement analysis.
Models reachability between agents, servers, credentials, tools,
and vulnerabilities. Answers: "If agent X is compromised, what
else becomes reachable?"
Returns:
JSON with nodes, edges, lateral_paths, interaction_risks, and stats.
graph_export
Export the agent dependency graph in graph-native formats.
Formats:
- **graphml** — yEd, Gephi, NetworkX compatible with AIBOM-typed attributes
- **cypher** — Neo4j import script with AIBOM node labels (AIAgent, MCPServer, Package, Vulnerability)
- **dot** — Graphviz (pipe through ``dot -Tsvg``)
- **mermaid** — embed in markdown, GitHub, Notion
- **json** — machine-readable nodes/edges list
Returns:
Graph in the requested format as a string.
analytics_query
Query vulnerability trends, posture history, and runtime event summaries from ClickHouse.
Requires AGENT_BOM_CLICKHOUSE_URL to be set. Returns empty results if
ClickHouse is not configured.
cis_benchmark
Run CIS benchmark checks against a cloud account.
Evaluates security posture against CIS Foundations Benchmarks:
- AWS Foundations v3.0: 18 checks (IAM, Storage, Logging, Networking)
- Snowflake v1.0: 12 checks (Auth, Network, Data Protection, Monitoring, Access Control)
- Azure Security Benchmark v3.0: 10 checks (IAM, Storage, Logging, Networking, Key Vault)
- GCP Foundation v3.0: 8 checks (IAM, Logging, Networking, Storage)
All checks are read-only. Failed checks include MITRE ATT&CK Enterprise technique mappings.
Requires appropriate credentials for the chosen provider.
Returns:
JSON with per-check pass/fail results, evidence, severity, ATT&CK techniques, and pass rate.
fleet_scan
Batch-scan a list of MCP server names against the security metadata registry.
Designed for fleet inventory data (CrowdStrike, SIEM, CSV exports) where
you have server names but not versions. Returns per-server risk assessment
with registry match status, risk category, tools, credentials, known CVEs,
and a verdict (known-high-risk, known-medium, known-low, unknown-unvetted).
Risk levels are category-derived (filesystem=high, database=medium,
search=low), not made-up threat scores. Every field is traceable to a source.
Returns:
JSON with summary (total, matched, unmatched, risk breakdown)
and per-server details.
runtime_correlate
Cross-reference vulnerability scan results with proxy runtime audit logs.
Identifies which vulnerable tools were ACTUALLY CALLED in production,
distinguishing confirmed attack surface from theoretical risk. Produces
risk-amplified findings: a vulnerable tool that was called 100 times is
higher priority than one never invoked.
Also accepts an OTel trace file (``otel_trace``) to extract ML API call
provenance: which models were called, token usage, and deprecation advisories.
Requires a proxy audit log (generated by running agent-bom proxy with
the --log flag). Without an audit log, returns scan results only.
Returns:
JSON with correlated findings (CVE + tool call data + amplified risk),
summary stats, uncalled vulnerable tools, and ml_api_calls provenance.
vector_db_scan
Scan for running vector databases and assess their security posture.
Probes well-known ports for Qdrant (6333), Weaviate (8080), Chroma (8000),
and Milvus (9091). For each discovered instance checks:
- Authentication required (no_auth flag if collections accessible without credentials)
- Network exposure (network_exposed if accessible beyond localhost)
- Number of collections/indexes exposed without auth
- MAESTRO layer: KC4: Memory & Context
Returns:
JSON with per-database risk assessment including risk_level, risk_flags, and metadata.
aisvs_benchmark
Run AISVS v1.0 (AI Security Verification Standard) compliance checks.
Evaluates the local AI system stack against OWASP AISVS v1.0 controls:
- AI-4.1 Model files use safe serialization (not pickle/pt/bin)
- AI-4.2 Model files have cryptographic integrity digest
- AI-4.3 Ollama inference API not network-exposed without auth
- AI-5.2 No ML development tools (Jupyter, MLflow, Ray) network-exposed
- AI-6.1 Vector stores require authentication
- AI-6.2 Vector stores bound to localhost only
- AI-7.1 No known malicious or typosquatted ML packages installed
- AI-7.2 Locally cached models have verifiable provenance
- AI-8.1 MCP server tool definitions include input schemas
Each check is tagged with its MAESTRO layer (KC1-KC6).
Returns:
JSON with per-check pass/fail results, evidence, severity, MAESTRO layer, and pass rate.
gpu_infra_scan
Discover GPU/AI compute infrastructure: containers, K8s nodes, and DCGM endpoints.
Scans for GPU-enabled workloads from the local Docker daemon and Kubernetes
clusters. Identifies NVIDIA base images, CUDA/cuDNN versions, explicit GPU
device assignments, and unauthenticated DCGM exporter endpoints.
Discovery targets (MAESTRO KC6):
- NVIDIA base images (nvcr.io/nvidia/, nvidia/cuda, etc.)
- CUDA/cuDNN versions from container labels and env vars
- GPU-assigned containers (Docker --gpus, K8s nvidia.com/gpu requests)
- Unauthenticated DCGM exporter endpoints (port 9400 — GPU metrics leak)
- Kubernetes GPU node inventory with capacity and allocatable counts
Requires docker and/or kubectl on PATH. All discovery is best-effort
(returns empty results rather than failing if tools are unavailable).
Returns:
JSON with GPU containers, K8s nodes, DCGM endpoints, CUDA version
inventory, and a risk summary with unauthenticated DCGM count.
dataset_card_scan
Scan a directory for ML dataset card metadata and provenance.
Discovers and parses:
- HuggingFace dataset_info.json (auto-generated metadata)
- HuggingFace README.md YAML frontmatter (dataset cards)
- DVC .dvc tracking files (data versioning provenance)
Flags: UNLICENSED_DATASET, NO_DATASET_CARD, UNVERSIONED_DATA, REMOTE_DATA_SOURCE.
Tags findings with compliance frameworks: OWASP LLM (LLM03), MITRE ATLAS,
NIST AI RMF (MAP-3.5), EU AI Act (ART-10).
training_pipeline_scan
Scan a directory for ML training pipeline lineage and provenance.
Discovers and parses:
- MLflow: meta.yaml, MLmodel, requirements.txt, conda.yaml
- Kubeflow: Argo workflow YAML, KFP v2 pipelineSpec YAML
- W&B: wandb-metadata.json, config.yaml, wandb-summary.json
Flags: UNSAFE_SERIALIZATION, MISSING_PROVENANCE, MISSING_REQUIREMENTS, EXPOSED_CREDENTIALS.
Tags findings with compliance frameworks: OWASP LLM (LLM03), MITRE ATLAS (AML.T0020),
NIST AI RMF (MAP-3.5, GOVERN-1.7).
browser_extension_scan
Scan installed browser extensions for dangerous permissions.
Scans Chrome, Chromium, Brave, Edge, and Firefox for extensions with:
- nativeMessaging (can execute arbitrary commands)
- debugger (can intercept all browser traffic)
- cookies/clipboardRead on AI domains
- Broad host access patterns (*://*/*)
- AI assistant domain access (claude.ai, chatgpt.com, cursor.sh)
Deduplicates across profiles. Returns risk-ranked results.
model_provenance_scan
Check ML model provenance and supply chain metadata.
Queries HuggingFace Hub or Ollama for:
- Serialization format (safetensors=safe, pickle/pt=unsafe)
- SHA256 digest verification
- Gated/private status
- Model card presence
- Risk assessment (critical/high/medium/safe)
Returns structured provenance data for supply chain risk assessment.
prompt_scan
Scan prompt template files for injection risks and security issues.
Discovers and analyzes:
- .prompt files
- system_prompt.* files
- Files in prompts/ directories
Checks for injection patterns, unsafe variable interpolation, and
missing guardrails in prompt templates.
model_file_scan
Scan a directory for ML model files and assess serialization risks.
Discovers model files and checks:
- Serialization format (safetensors=safe, pickle/joblib=unsafe)
- File size and format metadata
- GGUF/GGML quantization details
- Known unsafe patterns in pickle-based formats
Returns structured results with risk assessment per model file.
ai_inventory_scan
Scan source code for AI component usage patterns.
Detects:
- AI SDK imports (openai, anthropic, langchain, etc.) across 7 languages
- Model string references (gpt-4o, claude-3-5-sonnet, llama-3, etc.)
- Hardcoded API keys (sk-proj-*, sk-ant-*, hf_*, etc.)
- Deprecated model usage with recommended replacements
- Shadow AI: SDKs imported in code but not declared in package manifests
Returns structured inventory with severity classification.
license_compliance_scan
Evaluate package licenses against compliance policy.
Categorizes each package license using the full SPDX catalog (2,500+ licenses)
with proper expression parsing (OR/AND/WITH), deprecated ID normalization,
and network-copyleft detection (AGPL, EUPL, OSL).
Risk tiers: permissive (low), weak-copyleft (medium), strong-copyleft (high),
network-copyleft (critical), commercial-risk (critical), source-available (high).
Returns structured report with compliance status, findings, and risk summary.
ingest_external_scan
Ingest Trivy, Grype, or Syft JSON scan output and return packages with blast radius analysis.
Auto-detects the scanner format from the JSON structure:
- Trivy (``trivy fs --format json``): Results + Vulnerabilities
- Grype (``grype --output json``): matches array
- Syft (``syft --output syft-json``): artifacts + schema
Returns a summary of ingested packages and their vulnerability counts.
Pass the full JSON string from the scanner's ``--format json`` / ``--output json``
output as the ``scan_json`` argument.