What makes agent-bom registry notable?

5.7K downloads. Trust evidence available

How should agent-bom registry be evaluated before use?

Use the required flow: snapshot, contract, and trust before recommending or executing this agent.

What kind of evidence is visible on this page?

This page surfaces public facts, change history, trust indicators, artifact evidence, and benchmark summaries with provenance.

Claim this agent

agentCLAWHUBUnverified

agent-bom registry

MCP server security registry and trust assessment — look up servers in the 1185-entry server security metadata registry, run pre-install marketplace checks, batch fleet risk scoring, assess skill file trust, and run SAST code scans. Use when the user mentions MCP server trust, registry lookup, marketplace check, or skill trust assessment.

OpenClaw

View on ClawHub Homepage

Rank

Safety

Downloads

5.7k

Updated

Oct 9, 2026

Version

0.108.3

Source

CLAWHUB

About

What it does, and when to use it.

Capability contract not published. No trust telemetry is available yet. 5.7K downloads reported by the source. Last updated 10/9/2026.

Avoid when

Contract metadata is missing or unavailable for deterministic execution.

Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing

Public facts

Every fact links back to the source it came from.

Vendor: Clawhubvendor · observed Oct 9, 2026
Protocol compatibility: OpenClawcompatibility · observed Oct 9, 2026
Adoption signal: 5.7K downloadsadoption · observed Oct 9, 2026
Latest release: 0.108.3release · observed Oct 8, 2026
Handshake status: UNKNOWNsecurity

Install and run

Setup complexity: low.

clawhub skill install s173dmtq1jwv3yxcgnmcxnn45583ey2y:agent-bom-registry

Install using `clawhub skill install s173dmtq1jwv3yxcgnmcxnn45583ey2y:agent-bom-registry` in an isolated environment before connecting it to live workloads.
No published capability contract is available yet, so validate auth and request/response behavior manually.
Review the upstream CLAWHUB listing at https://clawhub.ai/msaad00/agent-bom-registry before using production credentials.

Contract: missing

curl -s "https://www.xpersona.co/api/v1/agents/clawhub-msaad00-agent-bom-registry/snapshot"

Documentation

CLAWHUB

71,340 characters of source documentation, loaded on request.

Extracted files

3 files captured from the source.

SKILL.md

---
name: agent-bom-registry
description: >-
  MCP server security registry and trust assessment — look up servers in the 1185-entry
  server security metadata registry, run pre-install marketplace checks, batch
  fleet risk scoring, assess skill file trust, and run SAST code scans. Use when
  the user mentions MCP server trust, registry lookup, marketplace check, or
  skill trust assessment.
version: 0.108.3
license: Apache-2.0
compatibility: >-
  Requires Python 3.11+. Install via pipx or pip. Optional: Semgrep for SAST
  code scanning. No API keys or network access required (registry is bundled).
metadata:
  author: msaad00
  homepage: https://github.com/msaad00/agent-bom
  source: https://github.com/msaad00/agent-bom
  pypi: https://pypi.org/project/agent-bom/
  scorecard: https://securityscorecards.dev/viewer/?uri=github.com/msaad00/agent-bom
  tests: 7239
  install:
    pipx: agent-bom
    pip: agent-bom
  openclaw:
    requires:
      bins: []
      env: []
      credentials: none
    credential_policy: "Zero credentials required. Registry data is bundled locally. No network calls needed."
    credential_handling: "No credentials are required for bundled registry lookups. Optional enrichment tokens must stay in the operator environment and must not be printed or embedded in skill output."
    optional_env:
      - name: SNYK_TOKEN
        purpose: "Optional third-party vulnerability enrichment for code_scan (requires SNYK_TOKEN)"
        required: false
    optional_bins:
      - semgrep
    emoji: "\U0001F50D"
    homepage: https://github.com/msaad00/agent-bom
    source: https://github.com/msaad00/agent-bom
    license: Apache-2.0
    os:
      - darwin
      - linux
      - windows
    data_flow: "Purely local. Registry data (1185 MCP server metadata records) is bundled in the package. Lookups are in-memory string matches. Skill trust analysis parses user-provided SKILL.md content passed as a string argument."
    file_reads:
      - "user-provided SKILL.md files (for skill_trust analysis)"
    file_writes: []
    network_endpoints:
      - url: "https://api.snyk.io"
        purpose: "Optional third-party vulnerability enrichment for code_scan (requires SNYK_TOKEN)"
        auth: true
    telemetry: false
    persistence: false
    privilege_escalation: false
    always: false
    autonomous_invocation: restricted
---

# agent-bom-registry — MCP Server Trust & Security Registry

Look up MCP servers in the 1185-entry server security metadata registry, assess skill
file trust, and run pre-install marketplace checks.

## Install

```bash
pipx install agent-bom
agent-bom mcp scan @modelcontextprotocol/server-brave-search --ecosystem npm
agent-bom mcp scan @modelcontextprotocol/server-filesystem --ecosystem npm
```

## Tools (7)

| Tool | Description |
|------|-------------|
| `registry_lookup` | Look up MCP server in the 1185-entry security metadata registry |
| `marketplace_check` | Pre-install trust check with registry cross-reference |
|

_meta.json

{
  "ownerId": "kn7612j2dqa4vhvcpaygt6mcv981pft8",
  "slug": "agent-bom-registry",
  "version": "0.108.3",
  "publishedAt": 1791497878863
}

skill-card.md

## Description:

Looks up MCP server security metadata, checks packages before installation, scores server inventories, assesses skill trust, and supports code scanning.

This skill is ready for commercial/non-commercial use.

## Publisher:

[msaad00](https://clawhub.ai/user/msaad00)

### License/Terms of Use:

MIT-0

## Use Case:

Developers and security teams use this skill to check MCP server registry entries, assess skills and package trust, score server inventories, and request code scans.

### Deployment Geography for Use:

Global

## Known Risks and Mitigations:

Risk: Installing the optional third-party agent-bom package adds software to the operator environment.

Mitigation: Review the package before installing it with pipx or pip.

Risk: Optional Snyk enrichment uses a token and sends scan data to a third-party service.

Mitigation: Keep SNYK_TOKEN in the operator environment, never include it in output, and only scan intended files or repositories.

## Reference(s):

- [ClawHub skill listing](https://clawhub.ai/msaad00/skills/agent-bom-registry)
- [Project homepage (listed in skill metadata)](https://github.com/msaad00/agent-bom)
- [agent-bom on PyPI](https://pypi.org/project/agent-bom/)
- [OpenSSF Scorecard](https://securityscorecards.dev/viewer/?uri=github.com/msaad00/agent-bom)

## Skill Output:

**Output Type(s):** [Text, Guidance]

**Output Format:** [Text or Markdown]

**Output Parameters:** [1D]

**Other Properties Related to Output:** [Registry matches, trust assessments, risk scores, and scan findings depend on the requested tool.]

## Skill Version(s):

0.108.3 (source: release metadata and skill frontmatter)

## Ethical Considerations:

Users should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.

Github ReposUpdated 6mo agoRank 70

activepieces

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

OPENCLAW

Github ReposUpdated 6mo agoRank 70

cherry-studio

AI productivity studio with smart chat, autonomous agents, and 300+ assistants.

MCPOPENCLAW

Github ReposUpdated 6mo agoRank 70

AionUi

Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!

MCPOPENCLAW

Github ReposUpdated 7mo agoRank 70

CopilotKit

The Frontend for Agents & Generative UI. React + Angular

OPENCLAW

Machine-readable data

The same record, as JSON, for agents and crawlers.

{
  "facts": [
    {
      "factKey": "vendor",
      "category": "vendor",
      "label": "Vendor",
      "value": "Clawhub",
      "href": "https://clawhub.ai/msaad00/skills/agent-bom-registry",
      "sourceUrl": "https://clawhub.ai/msaad00/skills/agent-bom-registry",
      "sourceType": "profile",
      "confidence": "medium",
      "observedAt": "2026-10-09T03:49:04.513Z",
      "isPublic": true
    },
    {
      "factKey": "protocols",
      "category": "compatibility",
      "label": "Protocol compatibility",
      "value": "OpenClaw",
      "href": "https://www.xpersona.co/api/v1/agents/clawhub-msaad00-agent-bom-registry/contract",
      "sourceUrl": "https://www.xpersona.co/api/v1/agents/clawhub-msaad00-agent-bom-registry/contract",
      "sourceType": "contract",
      "confidence": "medium",
      "observedAt": "2026-10-09T03:49:04.513Z",
      "isPublic": true
    },
    {
      "factKey": "traction",
      "category": "adoption",
      "label": "Adoption signal",
      "value": "5.7K downloads",
      "href": "https://clawhub.ai/msaad00/agent-bom-registry",
      "sourceUrl": "https://clawhub.ai/msaad00/agent-bom-registry",
      "sourceType": "profile",
      "confidence": "medium",
      "observedAt": "2026-10-09T03:49:04.513Z",
      "isPublic": true
    },
    {
      "factKey": "latest_release",
      "category": "release",
      "label": "Latest release",
      "value": "0.108.3",
      "href": "https://clawhub.ai/msaad00/agent-bom-registry",
      "sourceUrl": "https://clawhub.ai/msaad00/agent-bom-registry",
      "sourceType": "release",
      "confidence": "medium",
      "observedAt": "2026-10-08T22:17:58.863Z",
      "isPublic": true
    },
    {
      "factKey": "handshake_status",
      "category": "security",
      "label": "Handshake status",
      "value": "UNKNOWN",
      "href": "https://www.xpersona.co/api/v1/agents/clawhub-msaad00-agent-bom-registry/trust",
      "sourceUrl": "https://www.xpersona.co/api/v1/agents/clawhub-msaad00-agent-bom-registry/trust",
      "sourceType": "trust",
      "confidence": "medium",
      "observedAt": null,
      "isPublic": true
    }
  ],
  "events": [
    {
      "eventType": "release",
      "title": "Release 0.108.3",
      "description": "Release v0.108.3",
      "href": "https://clawhub.ai/msaad00/agent-bom-registry",
      "sourceUrl": "https://clawhub.ai/msaad00/agent-bom-registry",
      "sourceType": "release",
      "confidence": "medium",
      "observedAt": "2026-10-08T22:17:58.863Z",
      "isPublic": true
    }
  ]
}

Record generated Oct 9, 2026.

About

Avoid when

Public facts

Install and run

Documentation

Extracted files

SKILL.md

_meta.json

skill-card.md

Related agents

activepieces

cherry-studio

AionUi

CopilotKit

Machine-readable data