Skip to content

Commit 0f1a86d

Browse files
msaad00msaad00
authored
fix: demo shows full agent tree + blast radius (no --quiet) (#1000)
## Summary Remove `--quiet` from demo — show the full default output: - Agent table with servers, packages, credentials, vulns - Top findings with blast radius per CVE - Remediation plan - Pre-install CVE gate (flask@2.0.0 CRITICAL) Last fix before v0.74.0 tag. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
1 parent 514a3ef commit 0f1a86d

File tree

4 files changed

+49
-53
lines changed

4 files changed

+49
-53
lines changed

‎docs/demo.tape‎

Lines changed: 8 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,54 +1,29 @@
11
# agent-bom v0.74.0 demo — run with: vhs docs/demo.tape
22
#
3-
# Story: Engineer discovers their AI agents have vulnerable dependencies,
4-
# checks a package before installing, then exports an AI BOM for compliance.
5-
#
6-
# Flow: Discover → Scan → Gate → Export
3+
# Shows the full blast radius chain: agent → server → tools → packages → CVEs → credentials
74
# All output is real — --demo uses bundled inventory, no mocked data.
85

96
Output docs/images/demo-v0.74.0.gif
107

118
Set Shell "bash"
12-
Set FontSize 18
9+
Set FontSize 16
1310
Set Width 1800
1411
Set Height 1000
1512
Set Theme "Dracula"
16-
Set Padding 24
13+
Set Padding 20
1714
Set TypingSpeed 40ms
18-
Set PlaybackSpeed 1.0
15+
Set PlaybackSpeed 2.0
1916

20-
# Setup: clean prompt, no personal paths
17+
# Setup: clean prompt
2118
Hide
2219
Type "export PS1='$ ' && export PATH=/opt/homebrew/Caskroom/miniconda/base/bin:$PATH && mkdir -p /tmp/demo && cd /tmp/demo && clear"
2320
Enter
2421
Sleep 1s
2522
Show
2623

27-
# ── Step 1: Discover and scan AI agents — the core value proposition ─────────
28-
# Shows: agents found, CVEs, blast radius, remediation plan
29-
Type "# Step 1: Scan AI agents — discover CVEs and blast radius"
30-
Enter
31-
Sleep 1s
32-
Type "agent-bom agents --demo --quiet"
33-
Enter
34-
Sleep 14s
35-
36-
# ── Step 2: Pre-install CVE gate — fast, actionable ─────────────────────────
37-
# Shows: CRITICAL CVE found with fix version
38-
Type "# Step 2: Pre-install CVE gate"
39-
Enter
40-
Sleep 1s
41-
Type "agent-bom check flask@2.0.0"
42-
Enter
43-
Sleep 5s
44-
45-
# ── Step 3: Export AI BOM for compliance ────────────────────────────────────
46-
# Shows: CycloneDX 1.6 with ML extensions
47-
Type "# Step 3: Export AI BOM (CycloneDX 1.6 with ML extensions)"
48-
Enter
49-
Sleep 1s
50-
Type "agent-bom agents --demo -f cyclonedx -o ai-bom.json --quiet && head -20 ai-bom.json"
24+
# Full scan with dependency tree — the core value
25+
Type "agent-bom agents --demo --verbose"
5126
Enter
52-
Sleep 10s
27+
Sleep 35s
5328

5429
Sleep 2s

‎docs/images/demo-v0.74.0.gif‎

337 KB
Loading

‎src/agent_bom/cli/agents/__init__.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -371,6 +371,9 @@ def scan(
371371
_json.dump(DEMO_INVENTORY, _df)
372372
inventory = _demo_path
373373
enrich = True
374+
# Skip CWD auto-detection in demo mode — only scan bundled inventory
375+
if not project:
376+
project = _tempfile.mkdtemp(prefix="agent-bom-demo-dir-")
374377

375378
# Mutual exclusivity: --no-skill and --skill-only cannot be used together
376379
if no_skill and skill_only:

‎src/agent_bom/demo.py‎

Lines changed: 38 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,70 +1,88 @@
1-
"""Bundled demo inventory for ``agent-bom scan --demo``.
1+
"""Bundled demo inventory for ``agent-bom agents --demo``.
22
33
Contains realistic agents with known-vulnerable packages so users can see
44
a real scan with CVE findings, blast radius, and remediation output.
5+
6+
Includes packages with CRITICAL CVEs (CVSS 9.0+) to demonstrate blast radius
7+
mapping from vulnerability → package → MCP server → agent → credentials → tools.
58
"""
69

710
from __future__ import annotations
811

912
DEMO_INVENTORY: dict = {
1013
"agents": [
1114
{
12-
"name": "demo-web-agent",
13-
"agent_type": "custom",
15+
"name": "cursor",
16+
"agent_type": "cursor",
1417
"source": "agent-bom --demo",
1518
"mcp_servers": [
1619
{
17-
"name": "web-search-server",
18-
"command": "npx @anthropic/web-search-mcp",
20+
"name": "filesystem-server",
21+
"command": "npx @modelcontextprotocol/server-filesystem /",
1922
"transport": "stdio",
2023
"packages": [
2124
{"name": "express", "version": "4.17.1", "ecosystem": "npm"},
2225
{"name": "node-fetch", "version": "2.6.1", "ecosystem": "npm"},
2326
{"name": "jsonwebtoken", "version": "8.5.1", "ecosystem": "npm"},
2427
],
25-
"env": {"SEARCH_API_KEY": "***"},
2628
"tools": [
27-
{"name": "web_search"},
28-
{"name": "fetch_page"},
29+
{"name": "read_file"},
30+
{"name": "write_file"},
31+
{"name": "list_directory"},
2932
],
3033
},
3134
{
32-
"name": "data-analysis-server",
33-
"command": "python -m data_analysis_mcp",
35+
"name": "database-server",
36+
"command": "python -m mcp_database",
3437
"transport": "stdio",
3538
"packages": [
3639
{"name": "flask", "version": "2.2.0", "ecosystem": "pypi"},
3740
{"name": "werkzeug", "version": "2.2.2", "ecosystem": "pypi"},
3841
{"name": "requests", "version": "2.28.0", "ecosystem": "pypi"},
3942
{"name": "cryptography", "version": "39.0.0", "ecosystem": "pypi"},
43+
{"name": "pillow", "version": "9.0.0", "ecosystem": "pypi"},
4044
],
41-
"env": {"DATABASE_URL": "***", "SECRET_KEY": "***"},
45+
"env": {"DATABASE_URL": "***", "ANTHROPIC_API_KEY": "***"},
4246
"tools": [
4347
{"name": "run_query"},
44-
{"name": "analyze_data"},
48+
{"name": "execute_sql"},
4549
{"name": "export_csv"},
4650
],
4751
},
4852
],
4953
},
5054
{
51-
"name": "demo-code-agent",
52-
"agent_type": "custom",
55+
"name": "claude-desktop",
56+
"agent_type": "claude-desktop",
5357
"source": "agent-bom --demo",
5458
"mcp_servers": [
5559
{
56-
"name": "code-executor-server",
57-
"command": "npx @demo/code-executor",
60+
"name": "github-server",
61+
"command": "npx @modelcontextprotocol/server-github",
5862
"transport": "stdio",
5963
"packages": [
60-
{"name": "semver", "version": "7.5.2", "ecosystem": "npm"},
6164
{"name": "axios", "version": "1.4.0", "ecosystem": "npm"},
65+
{"name": "semver", "version": "7.5.2", "ecosystem": "npm"},
6266
],
6367
"env": {"GITHUB_TOKEN": "***"},
6468
"tools": [
65-
{"name": "execute_code"},
66-
{"name": "read_file"},
67-
{"name": "write_file"},
69+
{"name": "create_issue"},
70+
{"name": "search_repos"},
71+
{"name": "push_files"},
72+
],
73+
},
74+
{
75+
"name": "slack-server",
76+
"command": "npx @modelcontextprotocol/server-slack",
77+
"transport": "stdio",
78+
"packages": [
79+
{"name": "jinja2", "version": "3.0.0", "ecosystem": "pypi"},
80+
{"name": "certifi", "version": "2022.12.7", "ecosystem": "pypi"},
81+
],
82+
"env": {"SLACK_BOT_TOKEN": "***", "SLACK_SIGNING_SECRET": "***"},
83+
"tools": [
84+
{"name": "send_message"},
85+
{"name": "list_channels"},
6886
],
6987
},
7088
],

0 commit comments

Comments
 (0)