agent-bom

URL: https://pypi.org/project/agent-bom/#history
Justification: "All previous versions are permanently available on PyPI and as Docker Hub tags (e.g., agentbom/agent-bom:0.68.1). GitHub Releases archive every version with changelogs. The project follows semver — breaking changes are documented in release notes. Upgrade path is pip install --upgrade agent-bom."

GitHub Issues is used to track all individual bugs, features, and tasks.
https://github.com/msaad00/agent-bom/issues

Justification: "No external vulnerability reports have been received or resolved in the last 12 months. The project's security advisory process (SECURITY.md) commits to crediting reporters. When vulnerabilities are reported in the future, credit will be given in the GitHub Security Advisory and release notes unless the reporter requests anonymity."

URL: https://github.com/msaad00/agent-bom/blob/main/SECURITY.md
Justification: "SECURITY.md documents the full vulnerability response process: report via GitHub Security Advisories (private), triage within 48 hours, fix timeline based on severity (critical: 7 days, high: 14 days, medium: 30 days), coordinated disclosure, and reporter credit. Supported versions are documented."

URL: https://github.com/msaad00/agent-bom/blob/main/CONTRIBUTING.md
Justification: "The project uses Ruff for both linting and formatting, configured in pyproject.toml. CONTRIBUTING.md documents the coding standards. The style follows Ruff's defaults (based on Black formatting + pycodestyle/pyflakes/isort rules)."

URL: https://github.com/msaad00/agent-bom/blob/main/.pre-commit-config.yaml
Justification: "Coding standards are automatically enforced via pre-commit hooks (ruff check --fix + ruff format) on every commit, and CI runs ruff lint on every PR. PRs that violate the coding style fail CI and cannot be merged."

Justification: "agent-bom is a pure Python project. No native binaries are compiled. Installation is via pip install agent-bom (wheel distribution)."

Justification: "agent-bom is a pure Python project with no compilation step. Python bytecode (.pyc) is generated at runtime by the interpreter, not by a build system."

Justification: "agent-bom is a pure Python project using standard pyproject.toml-based packaging. No recursive build system or cross-dependency subdirectories exist."

Justification: "agent-bom is a pure Python project. Source code is used directly by the interpreter — no compilation occurs."

URL: https://pypi.org/project/agent-bom/
Justification: "Install via pip install agent-bom (standard Python convention). Uninstall via pip uninstall agent-bom. Also available as Docker images (docker pull agentbom/agent-bom) and as a GitHub Action."

Justification: "agent-bom is installed via pip, which handles installation paths according to Python packaging standards (site-packages, virtual environments). There is no custom installation system that needs to honor DESTDIR."

URL: https://github.com/msaad00/agent-bom/blob/main/CONTRIBUTING.md
Justification: "Developer setup is documented in CONTRIBUTING.md: git clone, pip install -e '.[dev,test]', pre-commit install. This installs all dependencies, test tools (pytest), and linting hooks in one step using standard Python conventions."

URL: https://github.com/msaad00/agent-bom/blob/main/pyproject.toml
Justification: "All external dependencies are declared in pyproject.toml under [project.dependencies] and [project.optional-dependencies]. This is the standard machine-readable Python packaging format, consumed by pip, uv, and other tools."

URL: https://github.com/msaad00/agent-bom/blob/main/.github/dependabot.yml
Justification: "Dependabot is enabled for both pip (Python) and npm (Next.js UI) dependencies, automatically opening PRs for known vulnerabilities. Additionally, the CI pipeline runs a self-scan dogfood job (agent-bom scan) on every PR, and GitHub's dependency graph with security alerts is active on the repository."

Justification: "All external dependencies are declared in pyproject.toml with standard version specifiers. Updates are performed via pip install --upgrade or Dependabot PRs. No vendored/convenience copies of external libraries exist — all components are installed from PyPI using standard Python packaging."

Justification: "The project uses current, non-deprecated APIs throughout: Python 3.10+ typing (no typing_extensions for available features), asyncio (not legacy event loop APIs), pathlib (not os.path where applicable), httpx (not urllib2). Ruff linting rules flag deprecated stdlib usage. Dependencies are kept current via Dependabot."

URL: https://github.com/msaad00/agent-bom/blob/main/.github/workflows/ci.yml
Justification: "CI runs on every push and PR to main. The test suite (4,600+ pytest tests) runs across Python 3.10/3.11/3.12, producing pass/fail reports. Additional CI jobs include linting, security scan, Docker build+scan, self-scan dogfood, and version alignment checks — 9 jobs total."

Justification: "Over 90% of bug fix commits in the last six months include regression tests. This is documented as policy in CONTRIBUTING.md. Examples: EPSS batch pagination fix (#538) included pagination boundary tests, NVIDIA advisory filter fix included torch/vllm regression tests, proxy DoS hardening included message size limit tests."

URL: https://github.com/msaad00/agent-bom/blob/main/.github/workflows/ci.yml
Justification: "CI enforces a minimum statement coverage threshold via pytest-cov --cov-fail-under. The project has 4,600+ tests across 179 test files. Coverage is actively being raised toward 80% (tracked by #529)."

URL: https://github.com/msaad00/agent-bom/blob/main/CONTRIBUTING.md
Justification: "CONTRIBUTING.md mandates tests for all new functionality and bug fixes. CI enforces this — PRs without adequate test coverage fail the pytest-cov threshold check and cannot be merged. Branch protection requires all CI checks to pass."

CONTRIBUTING.md documents the requirement to add tests with new functionality. PR templates also remind contributors to include tests. https://github.com/msaad00/agent-bom/blob/main/CONTRIBUTING.md

ruff is configured with a broad rule set in pyproject.toml. Only narrow per-file ignores are added where required by external conventions (e.g. atheris requires \TestOneInput capitalization). https://github.com/msaad00/agent-bom/blob/main/pyproject.toml

URL: https://github.com/msaad00/agent-bom/blob/main/THREAT_MODEL.md
Justification: "The project implements secure design principles throughout: least privilege (read-only API calls, localhost-only defaults), defense in depth (7 proxy detectors, input validation, path traversal protection), fail-safe defaults (--gpu-scan/--k8s-mcp require explicit opt-in), complete mediation (all proxy traffic inspected before relay), separation of privilege (OIDC/JWT auth, API key auth). THREAT_MODEL.md documents trust boundaries, attack surfaces, and mitigations with MITRE ATT&CK mappings."