Agent Bom Analyze

agent-bom-analyze — Blast Radius & Attack Path Analysis

Analyzes blast radius, attack paths, and the threat landscape across your AI infrastructure. Maps lateral movement risks, identifies high-impact CVEs, and visualizes agent context graphs.

Install

pipx install agent-bom
agent-bom scan --verbose   # blast radius detail for each agent
agent-bom scan -f json -o scan.json
agent-bom graph scan.json    # export graph from a saved JSON report

When to Use

• "blast radius" / "what's the blast radius"
• "threat intel" / "threat intelligence"
• "risk score" / "risk scoring"
• "attack path" / "attack paths"
• "lateral movement"
• "context graph" / "agent graph"
• "who can reach what"

Commands

# Blast radius detail (verbose)
agent-bom scan --verbose

# Generate context graph
agent-bom scan -f json -o scan.json
agent-bom graph scan.json

Tools

Examples

# Map blast radius of a specific CVE
blast_radius(cve_id="CVE-2024-21538")

# Build full context graph
context_graph()

# Query top CVEs by blast radius impact
analytics_query(query="top_blast_radius", days=30)

Example blast radius output:

CVE-2024-21538 — CRITICAL (CVSS 9.8, EPSS 0.94)
Blast Radius: 4 agents affected

  filesystem   [direct]  langchain 0.1.0 → CVE-2024-21538
    └─ github  [indirect] shares filesystem credential scope
    └─ slack   [indirect] accessible via filesystem tool call
  postgres     [direct]  langchain 0.1.0 → CVE-2024-21538

Recommended: Update langchain to ≥ 0.1.17

Guardrails

• Analysis is read-only — no files are modified.
• Only public CVE IDs are sent externally (to EPSS and vulnerability databases).
• No internal config data, credentials, or agent details leave the machine.
• Present blast radius findings clearly and ask the user whether to generate a remediation plan when CRITICAL CVEs are found.