koda-ai-studio/agent-bom

v0.110.0Apache-2.0

Inventory and audit your AI estate from the shell: scan MCP servers, agents and packages for CVEs, supply-chain risk and exposed credentials; audit MCP configs and skills for injection and risky grants; check a package before you add it; plan fixes. Runs a pinned local CLI; read-only by default.

GitHub Open Website

skills

check

Check a package or MCP server with agent-bom before installing or adding it - known CVEs, malicious or typosquatted names, and the fixed version. Use when the user is about to add an MCP server, install a dependency, or asks whether a package is safe.

License: Apache-2.0

Read SKILL.md at the source

Pinned to revision e42d0d569d9b, so it is the text this page describes rather than whatever the author pushed since.

Files

skills/check/SKILL.md

Every link opens the file at its source, pinned to the revision this page describes.