msaad00/agent-bom

v0.70.6 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

Published 2mo Vulnerability Scanning

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai-agents ai-security ai-supply-chain aibom blast-radius cloud-security

+14 more

compliance container-security cyclonedx security kubernetes llm-security mcp mcp-server owasp sarif sbom security-scanner supply-chain-security vulnerability-scanning

Summary

AI summary

Severity defaults now map unknown values to UNKNOWN instead of inflating to MEDIUM.

Full changelog

Scanner Accuracy & Robustness

Severity defaults fixed: All 5 scanner sources (OSV, GHSA, Snyk, local DB, SARIF) now default unknown severity to UNKNOWN instead of silently inflating to MEDIUM
EPSS null handling: Missing EPSS data stored as None (not 0.0 — which falsely implied "0% exploit risk")
CVSS 0.0 preserved: Legitimate CVSS 0.0 (NONE severity) no longer silently converted to None
Snyk severity: No more silent inflation from attrs.get("severity", "medium")

Null/None Handling

EPSS missing → None (not 0.0)
CVSS 0.0 → preserved (not falsy-converted to None)
Snyk unknown severity → UNKNOWN (not MEDIUM)
Severity chart includes NONE and UNKNOWN levels

Tool Count Alignment

All docs updated from stale 29/30 → 31 MCP tools (pyproject.toml, Dockerfile.sse, THREAT_MODEL.md, site-docs)

ClawHub Publish

Workflow rewritten with direct API calls (fixes acceptLicenseTerms server requirement)
Publishes 5 focused skills: agent-bom, agent-bom-scan, agent-bom-compliance, agent-bom-registry, agent-bom-runtime
Removed stale NVD_API_KEY from scan skill

DB & Migration

DB schema migration framework tested (3 new tests)
_cvss_to_severity(None) → "unknown" (not "medium")
NVD + GHSA co-equal DB sources fully wired

Test Coverage

6 new severity guard tests across all scanner sources
3 DB migration framework tests
All 6,000+ tests passing

Full Changelog: https://github.com/msaad00/agent-bom/compare/v0.70.5...v0.70.6

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track msaad00/agent-bom

Get notified when new releases ship.

About msaad00/agent-bom

AI supply chain security scanner with 18 MCP tools. Auto-discovers 20 MCP clients, scans dependencies for CVEs (OSV/NVD/EPSS/CISA KEV), maps blast radius from vulnerabilities to exposed credentials and tools, runs CIS benchmarks, generates CycloneDX/SPDX SBOMs, and enforces compliance across OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF, and EU AI Act.

All releases →