# Reported issues for agent-bom

Pod holds 6 of 6 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [agent-bom](/mcp/agent-bom).

## Most discussed

### base-image-vulnerability: agentbom/agent-bom:latest has actionable findings on linux/amd64

## Automated Base Image Vulnerability Alert

Daily image rescan found fixable `MEDIUM+` findings in `agentbom/agent-bom:latest`.

- Platform: `linux/amd64`
- SARIF category: `container-amd64`
- Source workflow: `.github/workflows/container-rescan.yml`
- Policy: container scans run with `agent-bom image --fail-on-severity medium --exclude-unfixable`

Review the GitHub Security tab and the workflow logs for the current image findings.

[Read the thread](https://github.com/msaad00/agent-bom/issues/4903) · 2026-08-22 · closed · outside contributor · 1 comment

### Proposal: lightweight pre-install dependency risk signal for AI agents

### Problem

Hi!

I’m building DepScout, a lightweight x402 API for checking npm, PyPI,
and GitHub dependencies before an AI agent installs them.

DepScout returns a compact safe, caution, or block verdict with public
risk signals.

I noticed that agent-bom focuses on AI, MCP, cloud, and supply-chain
security. Could a small pre-install dependency signal be useful alongside
agent-bom’s broader inventory and scanning workflows?

I’m looking for honest feedback and would be happy to provide a live 

[Read the thread](https://github.com/msaad00/agent-bom/issues/4344) · 2026-07-21 · closed · external user · 1 comment

### supply-chain-drift: Railway serving unknown, expected 0.75.15

## Supply-Chain Drift Check Failed

| Surface | Deployed | Expected |
|---------|----------|----------|
| Railway | unknown | 0.75.15 |
| Tool count | unknown | (check mcp_server.py) |

**Action**: Re-run the Deploy MCP SSE workflow or trigger a new release.

This issue was auto-created by the deployment-freshness workflow.

[Read the thread](https://github.com/msaad00/agent-bom/issues/1281) · 2026-04-07 · closed · outside contributor · 2 comments

### supply-chain-drift: Railway serving unknown, expected 0.75.15

## Supply-Chain Drift Check Failed

| Surface | Deployed | Expected |
|---------|----------|----------|
| Railway | unknown | 0.75.15 |
| Tool count | unknown | (check mcp_server.py) |

**Action**: Re-run the Deploy MCP SSE workflow or trigger a new release.

This issue was auto-created by the deployment-freshness workflow.

[Read the thread](https://github.com/msaad00/agent-bom/issues/1268) · 2026-04-06 · closed · outside contributor · 1 comment

### supply-chain-drift: Railway serving unknown, expected 0.75.14

## Supply-Chain Drift Check Failed

| Surface | Deployed | Expected |
|---------|----------|----------|
| Railway | unknown | 0.75.14 |
| Tool count | unknown | (check mcp_server.py) |

**Action**: Re-run the Deploy MCP SSE workflow or trigger a new release.

This issue was auto-created by the deployment-freshness workflow.

[Read the thread](https://github.com/msaad00/agent-bom/issues/1225) · 2026-04-04 · closed · outside contributor · 0 comments

### ci-regression: Publish to MCP Registry failing on main

Workflow **Publish to MCP Registry** failed on `main`.

- SHA: `48d9da3`
- Run: https://github.com/msaad00/agent-bom/actions/runs/23922217222
- Actor: @msaad00

This issue was opened automatically so main failures do not sit unnoticed.

[Read the thread](https://github.com/msaad00/agent-bom/issues/1180) · 2026-04-02 · closed · outside contributor · 1 comment

## Most recent

The remaining reports are on [the project's issue tracker](https://github.com/msaad00/agent-bom/issues).