agent-bom

Trigger one agentless Azure/GCP disk side-scan and read back honest state. Runs the same executor as ``agent-bom cloud side-scan`` and the REST ``POST /v1/cloud/side-scan``: snapshot the disk, mount a temp copy on an in-account collector read-only, record SBOM + CVE + secret *metadata* only, and tear every owned temporary resource down. Requires an admin operator + ``cloud:write`` scope. Credentials are never accepted here — the executor resolves read-only credentials from the provider's default chain (``credentialed_smoke=false``). Fail-closed and honest: OFF → ``disabled``; missing extra/cr…

Run SAST (Static Application Security Testing) on source code via Semgrep. Scans for security flaws: SQL injection, XSS, command injection, hardcoded credentials, insecure deserialization, path traversal, etc. Returns findings with CWE classifications and severity levels plus a typed ``findings``, ``clean``, ``skipped``, or ``failed`` status. Requires ``semgrep`` on PATH (``pip install semgrep``).

Return compliance posture with its source: the tenant's persisted evidence, or a labelled local scan. With completed scans in the control plane, ``summary`` is exactly ``/v1/compliance/summary``; ``framework`` adds ``/v1/compliance/{framework}`` and ``control`` pages the driving finding ids from ``/v1/findings?framework=&control=``. Otherwise (or with source='local_scan') it scans local MCP configurations and labels that scope.

Inspect action-scoped permission receipts under an explicit control assumption. Returns the pinned revision, denials, observations and missing evidence. Current access and successful execution are not established. Use the graph profile for investigation; an empty result leaves collection coverage unknown.

Trace experimental consequences, exact blockers and missing prerequisites. Agent/principal mode requires explicit assumed control. Vulnerability mode requires a linked affected occurrence. Current access and observed effects are never inferred. Session/exploitability producers remain unqualified.

Build an agent context graph with lateral movement analysis. Models reachability between agents, servers, credentials, tools, and vulnerabilities. Answers: "If agent X is compromised, what else becomes reachable?" Reads one agent page of the tenant's current estate graph by default (the agents ``GET /v1/graph?entity_types=agent`` pages, with their servers, packages, tools, credential names and advisories); ``scan_id`` reads that persisted scan instead. Live host discovery runs only with ``live=true`` or a ``config_path``; a tenant without a snapshot gets an error, never a silent scan of thi…

Return chargeback / showback LLM spend rollups by cost-center and allocation tag. Spend is derived from token counts on ingested OpenTelemetry GenAI spans priced via the open cost model. Includes per-cost-center allocation, budget posture, and forecast. No prompts or responses are read.

Project LLM spend burn rate and budget runway for the active tenant. Derives a recent burn rate from persisted cost records and extrapolates to the configured budget, returning projected period spend, days of runway, and an exhaustion date. Reference only: a forecast never blocks a call and returns a clear status with null projections on sparse history.

Return LLM spend attribution (per agent/model/provider) and budget posture. Spend is derived from token counts on ingested OpenTelemetry GenAI spans priced via agent-bom's open cost model; no prompts or responses are read.

File an ITSM ticket for a finding through a stored connection. Connect-once: auth and the ITSM base URL come only from the stored, encrypted connection — no credential or link is passed here. Requires an admin operator + ``ticketing:write`` scope. Idempotent per finding.

Return expiring / overdue credential posture for control-plane secrets. Surfaces non-secret credential-expiry and rotation governance: which secrets are near expiry, overdue for rotation, or past max age, with an overall verdict. Never returns secret values.

Return attack paths whose source and target nodes are recorded in different vendors. Paths come in the global queue order. ``vendor_facets`` counts cross-vendor paths per (source vendor, target vendor) over the whole snapshot, whatever pair is selected; the unit is paths. Matches ``/v1/graph/attack-paths/cross-vendor``.

Scan a directory for ML dataset card metadata, provenance, and optionally PII/PHI content.

Compare a fresh scan against a baseline to find new and resolved vulns. Runs a new scan, then diffs it against the provided baseline (or the latest saved report). Shows new vulnerabilities, resolved ones, and changes in the package inventory. Not read-only: this persists the fresh scan to report history and may prune older saved reports, so it is annotated as a (destructive) write. Returns: JSON with new findings, resolved findings, new/removed packages, and a human-readable summary.

List open blueprint-drift incidents (observed runtime traffic outside the approved role blueprint). Each incident records the blueprint, drift score, and top violations so an operator can reconcile the agent or blueprint and resolve it.

Read scoped Jamf/Falcon inventory, freshness and collection gaps. No execution or compliance inference.

Collect read-only vendor inventory into durable evidence. Admin plus connectors:write required.

Return the attack-path queue in the dashboard's order, with why each path ranks where it does. Ranking is ``ranking.order`` (evidence tier, KEV, severity, evidence confidence, composite risk, credential count); every path carries ``rank``, ``evidenceTier``, ``isKev``, ``severity``, ``evidenceConfidence`` and ``rankingFactors``. Totals, filters and cursor pages match ``/v1/graph/attack-paths``.

Return one finding with its graph paths, who reaches it, its exploit story and its triage/VEX state.

Query the tenant's findings exactly as /v1/findings does, with a compact row projection. ``risk_score`` is 0-10 (advisory severity); ``effective_reach_score`` is 0-100 (exposure-weighted). Use ``finding_detail`` for one finding's paths.

Record a tenant-scoped finding triage decision to the exception store. Writes the same entry as the REST ``POST /v1/findings/triage`` endpoint. Requires an admin operator + ``findings:write`` scope. A ``not_affected`` decision requires an OpenVEX ``justification``.

Dry-run an inter-agent firewall decision without recording it to the control-plane tally.

Batch-scan a list of MCP server names against the security metadata registry. Designed for fleet inventory data (EDR, SIEM, CSV exports) where you have server names but not versions. Returns per-server risk assessment with registry match status, risk category, tools, credentials, known CVEs, and a verdict (known-high-risk, known-medium, known-low, unknown-unvetted). Risk levels are category-derived (filesystem=high, database=medium, search=low), not made-up threat scores. Every field is traceable to a source. Returns: JSON with summary (total, matched, unmatched, risk breakdown) and…

Return gateway policy, firewall, durable activity, and optional self-posture evidence.

Generate a Software Bill of Materials (SBOM) for your AI agent setup. Discovers AI agents and MCP servers, extracts all package dependencies, and generates a standards-compliant SBOM. Args: format: SBOM format — "cyclonedx" (CycloneDX 1.7) or "spdx" (SPDX 3.0). config_path: Path to a specific MCP config directory. If not provided, auto-discovers all local agent configs. Returns: JSON string containing the SBOM in the requested format.

Discover GPU/AI compute infrastructure: containers, K8s nodes, and DCGM endpoints.

Create one bounded, provenance-rich correlation snapshot.

Read run state, receipts, freshness, conflicts, and analysis bounds.

Return what changed between two graph snapshots exactly as /v1/graph/diff does, or per source with view=estate. Rows are ordered nodes before edges, then added/removed/changed, then id; ``total`` counts every row matching the filters, not one page.

Export the agent dependency graph in graph-native formats. Formats: - **graphml** — yEd, Gephi, NetworkX compatible with AIBOM-typed attributes - **cypher** — Neo4j import script with AIBOM node labels (AIAgent, MCPServer, Package, Vulnerability) - **dot** — Graphviz (pipe through ``dot -Tsvg``) - **mermaid** — embed in markdown, GitHub, Notion - **json** — machine-readable nodes/edges list Returns: Graph in the requested format as a string.

Page the nodes connected to a node over recorded edges, with walk completeness. A recorded edge is not proof of execution; ``interpretation`` and ``completeness`` say what the bounded walk does and does not establish.

Grant an identity time-bound JIT access to one tool. Requires admin role, identity:write scope, and an audit reason.

Issue a managed agent identity. Requires admin role, identity:write scope, and an audit reason. Returns the raw token once.

Revoke a managed identity immediately. Requires admin role, identity:write scope, and an audit reason.

Revoke an active JIT grant immediately. Requires admin role, identity:write scope, and an audit reason.

Rotate a managed identity, keeping the old token live during the overlap window. Requires admin role, identity:write scope, and an audit reason.

Ingest external SARIF, SBOM, or scanner JSON without executing its producer. This tool mutates the control plane when ``parse_only`` is false: it bulk-ingests findings and, with ``reconcile_absent``, resolves open findings absent from the batch. That write path is gated as a destructive action requiring the ``findings:write`` scope. ``parse_only`` requests parse locally only and stay a read.

Return a local analyst threat brief from governed intel sources.

Look up one advisory from the local threat-intel database.

Match package inventory coordinates to local threat-intel advisories.

Return canonical threat-intel sources and local feed-run freshness.

List all discovered MCP configurations and servers without CVE scanning.

Return asset attributes and a bounded recorded relationship page. Reuse scan_id, snapshot_generation, and next_cursor for continuation. Completeness covers this page; blast-radius impact is not evaluated.

Return a filtered, paginated page of inventory asset rows. Every filter and the exact whole-query total is evaluated natively by the graph store. Facets are self-excluding and never derived from the displayed page. Page deep with ``pagination.next_cursor``. Findings never appear in the list.

Return unified asset-inventory counts by type and source group. Counts every non-finding asset in the tenant's current graph estate — AI (agents, MCP servers, models, tools, credentials), cloud (resources, data stores, accounts), Snowflake, and identity — bucketed by OCSF entity type and by operator-facing group (ai / cloud / identity / secrets / code). Findings (CVEs, misconfigurations) are excluded; use blast_radius or exposure_paths for the finding queue.

Evaluate live Kubernetes cluster security posture (KSPM). Read-only inspection of running workloads, RBAC, NetworkPolicy coverage, and (opt-in) kubelet config against the pinned CIS Kubernetes Benchmark. Distinct from image discovery: this returns SECURITY POSTURE, not a container-image inventory. Every collector carries an explicit execution state — executed / skipped / unevaluable (a denied or absent read) / failed — so a partial run is reported 'partial' with a coverage-affecting ScanRun issue and can never be laundered into a clean pass. The benchmark provenance, collector states, ScanRu…

Evaluate package licenses against an SPDX compliance policy. Takes packages (either a prior ``scan`` result JSON or an explicit array of ``{name, version, ecosystem, license}`` objects) and classifies each license as allowed, warn, or blocked. Normalizes 2,500+ SPDX IDs (including deprecated identifiers) and flags network-copyleft licenses (AGPL/SSPL/BUSL and similar). Args: scan_json: JSON of a previous scan result, or a JSON array of package objects with license metadata. policy_json: Optional JSON policy with ``license_block`` / ``license_warn`` glob lists. Falls b…

List tenant-scoped exception evidence from the canonical store.

Pre-install trust check for an MCP server package. Queries the package registry (npm or PyPI) for metadata and cross-references against the agent-bom MCP threat intelligence registry. Returns trust signals including download count, CVE status, and registry verification. Args: package: Package name to check. ecosystem: 'npm' or 'pypi'. Defaults to 'npm'. Returns: JSON with name, version, ecosystem, cve_count, download_count, registry_verified, and trust_signals.

Scan a directory for ML model files and assess serialization risks.

Check ML model provenance and supply chain metadata.

Discover non-human identities (Okta service apps / Entra service principals). Read-only and reference-only: returns normalized identity metadata (id, name, owner, created, credential expiry, scope references) — never secret material. Each provider is gated by its own discovery env flag and token; a disabled or unconfigured provider is reported in ``providers`` with a clear status rather than failing the request.

Evaluate a security policy against current scan results. Runs a scan, then evaluates the provided policy rules against the findings. Policies can gate on severity thresholds, CISA KEV status, AI risk flags, credential exposure, and denied packages. Args: policy_json: JSON string containing policy rules. Example: {"rules": [{"id": "no-critical", "severity_gte": "critical", "action": "fail"}, {"id": "no-kev", "kev": true, "action": "fail"}]} Returns: JSON with passed (bool), violations list, failure_count, and warning_count.

Scan prompt template files for prompt-injection and unsafe-interpolation risks. Walks the given directory for prompt assets (``.prompt`` files, ``system_prompt.*``, and ``prompts/`` directories), then statically inspects each template for injection-prone patterns and unsafe variable interpolation (untrusted input concatenated into instructions, missing delimiters, tool/role-confusion phrasing). Args: directory: Directory path to scan for prompt template files. Returns: JSON with the scanned files, per-file findings (rule id, severity, line, message), and a summary count by sever…

Return recent runtime proxy alerts without prompts, arguments, or responses.

Return current MCP proxy metrics and alert summary, if a session is active.

Query the agent-bom MCP server threat intelligence registry. Look up risk level, known tools, credential requirements, and verification status for known MCP servers. The registry contains 109+ servers with security metadata. Args: server_name: MCP server name to look up (e.g. "filesystem", "@modelcontextprotocol/server-github"). package_name: Package name to search for (e.g. "mcp-server-sqlite"). At least one of server_name or package_name is required. Returns: JSON with registry entry: risk_level, verified, tools, credential_env_vars, risk…

Sweep an entire cloud container registry: enumerate every repo+tag, dedupe by digest, cap, and scan each (read-only).

Generate a remediation plan for vulnerabilities in your AI agent setup. Scans for vulnerabilities, then generates actionable fix commands for each affected package (npm install, pip install), credential scope reduction guidance, and reports on unfixable vulnerabilities. Args: config_path: Path to a specific MCP config directory. If not provided, auto-discovers all local agent configs. image: Docker image reference to scan (e.g. "nginx:1.25"). Returns: JSON with package_fixes (upgrade commands by ecosystem), credential_fixes (scope reduction steps), and unfix…

Create a pending exception through the shared REST/UI/MCP lifecycle.

List, assign, ticket, or verify a tenant-scoped remediation campaign. Uses the same campaign store and verification service as REST and CLI. Writes require an authenticated admin operator with ``findings:write``.

Compare current runtime traffic with an approved role/profile blueprint.

Return canonical role/profile blueprints for runtime policy design.

Cross-reference vulnerability scan results with proxy runtime audit logs. Identifies which vulnerable tools were ACTUALLY CALLED in production, distinguishing confirmed attack surface from theoretical risk. Produces risk-amplified findings: a vulnerable tool that was called 100 times is higher priority than one never invoked. Also accepts an OTel trace file (``otel_trace``) to extract ML API call provenance: which models were called, token usage, and deprecation advisories. Requires a proxy audit log (generated by running agent-bom proxy with the --log flag). Without an audit log, returns s…

Ingest CWPP runtime/EDR workload signals into the local evidence store. Uses the configured control-plane API with a short-lived source-scoped credential from the server environment. No credential is a tool argument. Fail-closed on auth; never writes to a customer cloud target.

Return metadata-only runtime production posture for agent/tool traffic. Summarizes tool-call volume, block rate, policy decisions, authorization trace posture, alerts, active sources/sessions, freshness, and retention mode without returning prompts, raw arguments, responses, or credential values.

Run a full AI supply chain security scan and return an AI-BOM. Point it at a target with one of: • repo_url — a public git repo URL (cloned + scanned, no checkout) • config_path — a local project / MCP-config directory • image — a Docker image • sbom_path — an existing CycloneDX/SPDX SBOM • package — a single package or MCP launch command (pair it with ``ecosystem`` when the spec names no launcher) With none of these, it auto-discovers local MCP clients (Claude Desktop, Cursor, Windsurf, VS Code Copilot, OpenClaw, etc.). It extracts package de…

Run Shield break-glass override. Requires admin role, shield:write scope, and audit reason.

Start Shield enforcement for a session. Requires admin role, shield:write scope, and audit reason.

Return current Shield assessment for a session without changing enforcement state.

Unblock Shield enforcement for a session. Requires admin role, shield:write scope, and audit reason.

Return allow / warn / block / not_found for a candidate from every stored path of the snapshot. The candidate must exactly equal a path identifier (package name, name@version, purl, CVE/finding id, node id or label) in any of the ranked paths (``searchedPaths`` of ``total``); ``matchedPathCount`` counts every match and ``maxRisk`` is their highest risk. A KEV finding reached from an agent with credential exposure blocks unless ruled unlikely. No exact match returns ``not_found``. Unverified reachability never yields allow.

Scan skill and instruction files for trust, findings, and provenance.

Assess the trust level of a SKILL.md file using ClawHub-style categories.

Verify Sigstore provenance for skill and instruction files.

Refresh a filed ticket's status from its ITSM through the connection. Requires an admin operator + ``ticketing:write`` scope. Resolves auth and endpoint from the stored connection only.

Audit MCP descriptors, permission scope and authentication configuration. Also reports ``agent_permission_findings``: Claude Code settings and Codex config that let a coding agent act with no prompts or no sandbox. Returns descriptor coverage and heuristic findings; does not test auth bypass, general resource bodies or rendered prompts. Set live=false for passive discovery; live mode retains its stdio execution gate. Discovers configured MCP clients, connects to their servers, calls ``tools/list``, and classifies every exposed tool by capability (filesystem, network, code execution, credent…

Scan a directory for ML training pipeline lineage and provenance.

Scan for running vector databases and assess their security posture.

Verify package integrity and SLSA provenance against registries. Checks SHA-256/SRI hashes against npm/PyPI registries and looks up SLSA build provenance attestations to confirm the package was built from its claimed source repository. Returns: JSON with integrity verification (hash match, expected vs actual) and provenance status (SLSA level, source repo, build trigger).

Show all MCP discovery paths and which config files exist.

Search You.com for current web or news context.