Skip to content

Commit a026ef8

Browse files
msaad00agent-bom
andauthored
feat: full path enumeration in dry-run + where --json + v0.31.1 (#16)
- Replace hardcoded 3-path sample in --dry-run with full enumeration of all 25 discovery paths from CONFIG_LOCATIONS (fixes wrong ~/.codeium/windsurf path that never existed) - Add get_all_discovery_paths() to discovery module for reuse - Enhance `where` command: show totals, Docker MCP Toolkit paths, Docker Compose files, and --json output for machine auditing - Bump version to 0.31.1 across all files - Add 4 new tests for path enumeration and where --json (953 total) Addresses ClawHub OpenClaw scanner Instruction Scope feedback by making the fixed discovery scope fully transparent and auditable. Co-authored-by: Wagdy Saad <andwgdysaad@gmail.com>
1 parent e09839c commit a026ef8

File tree

13 files changed

+172
-33
lines changed

13 files changed

+172
-33
lines changed

Dockerfile.sse

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313

1414
FROM python:3.12-slim
1515

16-
ARG VERSION=0.31.0
16+
ARG VERSION=0.31.1
1717

1818
LABEL org.opencontainers.image.title="agent-bom MCP Server"
1919
LABEL org.opencontainers.image.description="AI supply chain security scanner — MCP server with streamable HTTP transport"

PUBLISHING.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ npm install -g clawhub@latest
102102
clawhub login --token "$CLAWHUB_TOKEN"
103103
clawhub publish integrations/openclaw \
104104
--slug agent-bom --name "agent-bom" \
105-
--version "0.31.0" --no-input --force
105+
--version "0.31.1" --no-input --force
106106
```
107107

108108
### Verification
@@ -138,8 +138,8 @@ Images published:
138138
Tag push triggers the full pipeline automatically:
139139

140140
```bash
141-
git tag v0.31.0
142-
git push origin v0.31.0
141+
git tag v0.31.1
142+
git push origin v0.31.1
143143
```
144144

145145
This triggers:

README.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ Console, HTML dashboard, SARIF, CycloneDX 1.6, SPDX 3.0, Prometheus, OTLP, JSON,
101101
|----------|------|
102102
| PyPI | `pip install agent-bom` |
103103
| Docker | `docker run agentbom/agent-bom scan` |
104-
| GitHub Action | `uses: msaad00/agent-bom@v0.31.0` |
104+
| GitHub Action | `uses: msaad00/agent-bom@v0.31.1` |
105105
| MCP Registry | [server.json](integrations/mcp-registry/server.json) |
106106
| ToolHive | [registry entry](integrations/toolhive/server.json) |
107107
| OpenClaw | [SKILL.md](integrations/openclaw/SKILL.md) |
@@ -315,7 +315,7 @@ agent-bom scan --aws -f graph -o graph.json # export graph data
315315
|------|---------|----------|
316316
| CLI | `agent-bom scan` | Local audit |
317317
| Pre-install check | `agent-bom check express@4.18.2 -e npm` | Before running MCP servers |
318-
| GitHub Action | `uses: msaad00/agent-bom@v0.31.0` | CI/CD + SARIF |
318+
| GitHub Action | `uses: msaad00/agent-bom@v0.31.1` | CI/CD + SARIF |
319319
| Docker | `docker run agentbom/agent-bom scan` | Isolated scans |
320320
| REST API | `agent-bom api` | Dashboards, SIEM |
321321
| MCP Server | `agent-bom mcp-server` | Inside any MCP client |
@@ -325,7 +325,7 @@ agent-bom scan --aws -f graph -o graph.json # export graph data
325325
### GitHub Action
326326

327327
```yaml
328-
- uses: msaad00/agent-bom@v0.31.0
328+
- uses: msaad00/agent-bom@v0.31.1
329329
with:
330330
severity-threshold: high
331331
upload-sarif: true

integrations/mcp-registry/server.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"name": "io.github.msaad00/agent-bom",
44
"description": "AI supply chain security scanner — CVE scanning, blast radius, policy enforcement, SBOM generation",
55
"title": "agent-bom",
6-
"version": "0.31.0",
6+
"version": "0.31.1",
77
"repository": {
88
"url": "https://github.com/msaad00/agent-bom",
99
"source": "github"
@@ -12,7 +12,7 @@
1212
{
1313
"registryType": "pypi",
1414
"identifier": "agent-bom",
15-
"version": "0.31.0",
15+
"version": "0.31.1",
1616
"transport": {
1717
"type": "stdio"
1818
},

integrations/openclaw/SKILL.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
name: agent-bom
33
description: Scan AI agents and MCP servers for CVEs, generate SBOMs, map blast radius, enforce security policies
4-
version: 0.31.0
4+
version: 0.31.1
55
metadata:
66
openclaw:
77
requires:
@@ -71,7 +71,7 @@ pipx install agent-bom
7171
### Verify installation
7272
```bash
7373
agent-bom --version
74-
# Should print: agent-bom 0.31.0
74+
# Should print: agent-bom 0.31.1
7575
```
7676

7777
### Verify source

integrations/toolhive/Dockerfile.mcp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
FROM python:3.12-slim
22

3-
ARG VERSION=0.31.0
3+
ARG VERSION=0.31.1
44

55
LABEL maintainer="W S <34316639+msaad00@users.noreply.github.com>"
66
LABEL description="agent-bom MCP Server: AI supply chain security scanning via MCP protocol"

integrations/toolhive/server.json

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,15 @@
33
"name": "io.github.msaad00/agent-bom",
44
"description": "AI supply chain security scanner — CVE scanning, blast radius analysis, policy enforcement, and SBOM generation for MCP servers and AI agents",
55
"title": "agent-bom",
6-
"version": "0.31.0",
6+
"version": "0.31.1",
77
"repository": {
88
"url": "https://github.com/msaad00/agent-bom",
99
"source": "github"
1010
},
1111
"packages": [
1212
{
1313
"registryType": "oci",
14-
"identifier": "ghcr.io/msaad00/agent-bom:v0.31.0",
14+
"identifier": "ghcr.io/msaad00/agent-bom:v0.31.1",
1515
"transport": {
1616
"type": "stdio"
1717
},
@@ -28,7 +28,7 @@
2828
"_meta": {
2929
"io.modelcontextprotocol.registry/publisher-provided": {
3030
"io.github.msaad00": {
31-
"ghcr.io/msaad00/agent-bom:v0.31.0": {
31+
"ghcr.io/msaad00/agent-bom:v0.31.1": {
3232
"tier": "Community",
3333
"status": "Active",
3434
"tags": [

pyproject.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
44

55
[project]
66
name = "agent-bom"
7-
version = "0.31.0"
7+
version = "0.31.1"
88
description = "AI Bill of Materials (AI-BOM) generator — CVE scanning, blast radius, enterprise remediation plans, OWASP LLM Top 10 + MITRE ATLAS + NIST AI RMF threat mapping, LLM-powered enrichment, OpenClaw discovery, MCP runtime introspection, and MCP registry for AI agents."
99
readme = "README.md"
1010
license = {text = "Apache-2.0"}

src/agent_bom/__init__.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,4 @@
55
try:
66
__version__ = version("agent-bom")
77
except PackageNotFoundError:
8-
__version__ = "0.31.0"
8+
__version__ = "0.31.1"

src/agent_bom/cli.py

Lines changed: 74 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -319,13 +319,9 @@ def scan(
319319
if config_dir:
320320
reads.append(f" [green]Would read:[/green] {config_dir} (config directory)")
321321
if not reads:
322-
import platform
323-
if platform.system() == "Darwin":
324-
reads.append(" [green]Would read:[/green] ~/Library/Application Support/Claude/claude_desktop_config.json")
325-
reads.append(" [green]Would read:[/green] ~/.cursor/mcp.json")
326-
reads.append(" [green]Would read:[/green] ~/.codeium/windsurf/mcp_config.json")
327-
else:
328-
reads.append(" [green]Would read:[/green] ~/.config/claude/claude_desktop_config.json")
322+
from agent_bom.discovery import get_all_discovery_paths
323+
for client, path in get_all_discovery_paths():
324+
reads.append(f" [green]Would read:[/green] {path} ({client})")
329325
for tf_dir in tf_dirs:
330326
reads.append(f" [green]Would read:[/green] {tf_dir} (Terraform .tf files)")
331327
for ap in agent_projects:
@@ -1535,17 +1531,49 @@ def validate(inventory_file: str):
15351531

15361532

15371533
@main.command()
1538-
def where():
1539-
"""Show where agent-bom looks for MCP configurations."""
1534+
@click.option("--json", "as_json", is_flag=True, help="Output as JSON for machine consumption")
1535+
def where(as_json: bool):
1536+
"""Show where agent-bom looks for MCP configurations.
1537+
1538+
Lists every config path that would be checked during auto-discovery,
1539+
grouped by MCP client. Paths that exist on your system are marked with ✓.
1540+
1541+
Use --json for machine-readable output (useful for auditing).
1542+
"""
15401543
import shutil
15411544

1545+
from agent_bom.discovery import (
1546+
AGENT_BINARIES,
1547+
COMPOSE_FILE_NAMES,
1548+
CONFIG_LOCATIONS,
1549+
PROJECT_CONFIG_FILES,
1550+
expand_path,
1551+
get_all_discovery_paths,
1552+
get_platform,
1553+
)
1554+
1555+
current_platform = get_platform()
1556+
1557+
if as_json:
1558+
import json as _json
1559+
entries = []
1560+
for client, path in get_all_discovery_paths(current_platform):
1561+
expanded = str(expand_path(path)) if not path.startswith(".") else path
1562+
entries.append({
1563+
"client": client,
1564+
"path": path,
1565+
"expanded": expanded,
1566+
"exists": expand_path(path).exists() if not path.startswith(".") else Path(path).exists(),
1567+
})
1568+
click.echo(_json.dumps({"platform": current_platform, "paths": entries}, indent=2))
1569+
return
1570+
15421571
console = Console()
15431572
console.print(BANNER, style="bold blue")
15441573
console.print("\n[bold]MCP Client Configuration Locations[/bold]\n")
15451574

1546-
from agent_bom.discovery import AGENT_BINARIES, CONFIG_LOCATIONS, PROJECT_CONFIG_FILES, expand_path, get_platform
1547-
1548-
current_platform = get_platform()
1575+
total_paths = 0
1576+
found_paths = 0
15491577

15501578
for agent_type, platforms in CONFIG_LOCATIONS.items():
15511579
paths = platforms.get(current_platform, [])
@@ -1560,16 +1588,48 @@ def where():
15601588
console.print(f"\n [bold cyan]{agent_type.value}[/bold cyan]{binary_status}")
15611589
if paths:
15621590
for p in paths:
1591+
total_paths += 1
15631592
expanded = expand_path(p)
15641593
exists = "✓" if expanded.exists() else "✗"
15651594
style = "green" if expanded.exists() else "dim"
1595+
if expanded.exists():
1596+
found_paths += 1
15661597
console.print(f" [{style}]{exists} {expanded}[/{style}]")
15671598
else:
15681599
console.print(f" [dim] (CLI-based discovery via {binary or 'N/A'})[/dim]")
15691600

1570-
console.print("\n [bold cyan]Project-level configs[/bold cyan]")
1601+
# Docker MCP Toolkit paths
1602+
console.print("\n [bold cyan]Docker MCP Toolkit[/bold cyan]")
1603+
for dp in ["~/.docker/mcp/registry.yaml", "~/.docker/mcp/catalogs/docker-mcp.yaml"]:
1604+
total_paths += 1
1605+
expanded = expand_path(dp)
1606+
exists = "✓" if expanded.exists() else "✗"
1607+
style = "green" if expanded.exists() else "dim"
1608+
if expanded.exists():
1609+
found_paths += 1
1610+
console.print(f" [{style}]{exists} {expanded}[/{style}]")
1611+
1612+
console.print("\n [bold cyan]Project-level configs[/bold cyan] [dim](relative to CWD)[/dim]")
15711613
for config_name in PROJECT_CONFIG_FILES:
1572-
console.print(f" [dim] ./{config_name}[/dim]")
1614+
total_paths += 1
1615+
exists = Path(config_name).exists()
1616+
mark = "✓" if exists else "✗"
1617+
style = "green" if exists else "dim"
1618+
if exists:
1619+
found_paths += 1
1620+
console.print(f" [{style}]{mark} ./{config_name}[/{style}]")
1621+
1622+
console.print("\n [bold cyan]Docker Compose files[/bold cyan] [dim](relative to CWD)[/dim]")
1623+
for cf in COMPOSE_FILE_NAMES:
1624+
total_paths += 1
1625+
exists = Path(cf).exists()
1626+
mark = "✓" if exists else "✗"
1627+
style = "green" if exists else "dim"
1628+
if exists:
1629+
found_paths += 1
1630+
console.print(f" [{style}]{mark} ./{cf}[/{style}]")
1631+
1632+
console.print(f"\n [bold]Total:[/bold] {total_paths} paths checked, {found_paths} found on this system")
15731633

15741634

15751635
@main.command()

0 commit comments

Comments
 (0)