Reported issues for agent-bom
Pod holds 6 of 6 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.
Back to agent-bom.
Most discussed
base-image-vulnerability: agentbom/agent-bom:latest has actionable findings on linux/amd64
Automated Base Image Vulnerability Alert
Daily image rescan found fixable MEDIUM+ findings in agentbom/agent-bom:latest.
- Platform:
linux/amd64 - SARIF category:
container-amd64 - Source workflow:
.github/workflows/container-rescan.yml - Policy: container scans run with
agent-bom image --fail-on-severity medium --exclude-unfixable
Review the GitHub Security tab and the workflow logs for the current image findings.
Read the thread · 2026-08-22 · closed · outside contributor · 1 comment
Proposal: lightweight pre-install dependency risk signal for AI agents
Problem
Hi!
I’m building DepScout, a lightweight x402 API for checking npm, PyPI, and GitHub dependencies before an AI agent installs them.
DepScout returns a compact safe, caution, or block verdict with public risk signals.
I noticed that agent-bom focuses on AI, MCP, cloud, and supply-chain security. Could a small pre-install dependency signal be useful alongside agent-bom’s broader inventory and scanning workflows?
I’m looking for honest feedback and would be happy to provide a live
Read the thread · 2026-07-21 · closed · external user · 1 comment
supply-chain-drift: Railway serving unknown, expected 0.75.15
Supply-Chain Drift Check Failed
| Surface | Deployed | Expected |
|---|---|---|
| Railway | unknown | 0.75.15 |
| Tool count | unknown | (check mcp_server.py) |
Action: Re-run the Deploy MCP SSE workflow or trigger a new release.
This issue was auto-created by the deployment-freshness workflow.
Read the thread · 2026-04-07 · closed · outside contributor · 2 comments
supply-chain-drift: Railway serving unknown, expected 0.75.15
Supply-Chain Drift Check Failed
| Surface | Deployed | Expected |
|---|---|---|
| Railway | unknown | 0.75.15 |
| Tool count | unknown | (check mcp_server.py) |
Action: Re-run the Deploy MCP SSE workflow or trigger a new release.
This issue was auto-created by the deployment-freshness workflow.
Read the thread · 2026-04-06 · closed · outside contributor · 1 comment
supply-chain-drift: Railway serving unknown, expected 0.75.14
Supply-Chain Drift Check Failed
| Surface | Deployed | Expected |
|---|---|---|
| Railway | unknown | 0.75.14 |
| Tool count | unknown | (check mcp_server.py) |
Action: Re-run the Deploy MCP SSE workflow or trigger a new release.
This issue was auto-created by the deployment-freshness workflow.
Read the thread · 2026-04-04 · closed · outside contributor · 0 comments
ci-regression: Publish to MCP Registry failing on main
Workflow Publish to MCP Registry failed on main.
- SHA:
48d9da3 - Run: https://github.com/msaad00/agent-bom/actions/runs/23922217222
- Actor: @msaad00
This issue was opened automatically so main failures do not sit unnoticed.
Read the thread · 2026-04-02 · closed · outside contributor · 1 comment
Most recent
The remaining reports are on the project's issue tracker.