agent-bom-registry — MCP Server Trust & Security Registry
Look up MCP servers in the 427+ server security metadata registry, assess skill
file trust, and run pre-install marketplace checks.
Install
CODEBLOCK0
Tools (7)
| Tool | Description |
|---|
| INLINECODE0 | Look up MCP server in 427+ server security metadata registry |
| INLINECODE1 |
Pre-install trust check with registry cross-reference |
|
fleet_scan | Batch registry lookup + risk scoring for MCP server inventories |
|
skill_scan | Scan instruction files for package refs, trust, and findings |
|
skill_verify | Verify Sigstore provenance for instruction files |
|
skill_trust | Assess skill file trust level (5-category analysis) |
|
code_scan | SAST scanning via Semgrep with CWE-based compliance mapping |
Example Workflows
CODEBLOCK1
MCP Resources
| Resource | Description |
|---|
| INLINECODE7 | Browse 427+ MCP server security metadata registry |
Privacy & Data Handling
Registry data is bundled in the package — lookups are in-memory string
matches with zero network calls. Skill trust analysis parses content passed
as a string argument (no file system access needed).
Verification
agent-bom-registry — MCP服务器信任与安全注册表
在包含427+服务器的安全元数据注册表中查询MCP服务器，评估技能文件的可信度，并运行安装前的市场检查。
安装
bash
pipx install agent-bom
agent-bom registry-lookup brave-search
agent-bom marketplace-check @anthropic/server-filesystem
工具（7个）
| 工具 | 描述 |
|---|
| registrylookup | 在427+服务器安全元数据注册表中查询MCP服务器 |
| marketplacecheck |
安装前信任检查，附带注册表交叉引用 |
| fleet_scan | 批量注册表查询 + MCP服务器清单风险评分 |
| skill_scan | 扫描指令文件中的包引用、信任度和发现项 |
| skill_verify | 验证指令文件的Sigstore来源 |
| skill_trust | 评估技能文件信任等级（5类分析） |
| code_scan | 通过Semgrep进行SAST扫描，附带基于CWE的合规映射 |
示例工作流
在注册表中查询服务器
registry
lookup(servername=brave-search)
安装前信任检查
marketplace_check(package=@modelcontextprotocol/server-filesystem)
扫描指令文件，然后评估特定技能文件
skill_scan(path=.)
skill
trust(skillpath=./SKILL.md)
批量风险评分
fleet_scan(servers=[brave-search, github, slack])
MCP资源
| 资源 | 描述 |
|---|
| registry://servers | 浏览427+ MCP服务器安全元数据注册表 |
隐私与数据处理
注册表数据打包在软件包中——查询为内存中的字符串匹配，零网络调用。技能信任分析解析作为字符串参数传递的内容（无需文件系统访问）。
验证
