AI Security · aibom

Your codebase is full of AI agents.
Do you know what they can do?

aibom is an open-source scanner that builds an AI Bill of Materials — every agent, model, tool, and MCP server in your repos — and flags the risky ones against the OWASP LLM Top 10. ScopeSafe turns those scans into continuous monitoring with PR gates.

Start monitoring Get the CLI

aibom — CI

$ pip install scopesafe-aibom && aibom . --upload

aibom: uploaded scan 3f2a91c4 (project 'payments-service')

findings: 1 new, 4 recurring, 2 resolved

gate: fail — 1 new high finding(s): AGENT-001: Agent 'support-bot' has destructive tools without human approval

What it finds

The inventory nobody has — with the risks attached.

Static analysis, zero dependencies, nothing executed. Scan any repo in seconds and get an AI-BOM you can hand to security, plus findings your CI can enforce.

Agents & models

LangChain, LangGraph, CrewAI, AutoGen, LlamaIndex and direct SDK usage — including graph idioms and cross-file wiring most scanners miss.

MCP servers & tools

Every MCP server your repo wires in, with scope classification (broad vs. scoped) and capability tags: filesystem, exec, network, delete.

OWASP-mapped posture

Excessive agency, broadly-scoped servers, destructive tools without human approval, hardcoded keys — each finding mapped to the OWASP LLM Top 10.

PR gating

The platform diffs each scan against history — new, recurring, resolved — and fails the build only on new critical/high findings.

Security work you can put your name on.

Start free in minutes — run authorized research or scan your codebase for AI risk, with every finding backed by tamper-evident evidence.

Start free See pricing