> ## Documentation Index
> Fetch the complete documentation index at: https://aspex.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# aspex bom

> Agent Security Bill of Materials: a portable, versioned description of what constitutes an agent environment.

```sh theme={"dark"}
aspex bom                          # tree for humans
aspex bom --json > agent.asbom.json
```

```
  Agent: Claude Code

  MCP servers
  ├── filesystem  12 tools · file-read, file-write · sensitive scope
  ├── github  26 tools · external-send, untrusted-ingress, data-read
  └── playwright  21 tools · network-send, untrusted-ingress, browser

  Skills
  ├── deploy  project · runs commands
  └── use-spark  user · runs commands

  Hooks
  └── PostToolUse  INFO · /Users/steven/.claude/onyx/onyx-scanner

  Sensitive resources reachable
  ├── ~/.ssh  read-write via filesystem
  ├── ~/.aws  read-write via filesystem
  └── agent config, hooks, instructions, memory (9 files)  write via filesystem

  External destinations
  ├── arbitrary https
  └── github.com

  Attack paths
  └── 2 CRITICAL, 1 HIGH

  Blast radius: HIGH
     ✓ reads credentials or sensitive files
     ✓ arbitrary external network egress
     ✗ command execution
     ...
```

## JSON schema

`aspex bom` and `.aspex.lock` are the same underlying environment model with different jobs:

* **`aspex bom`** answers *what constitutes this agent environment?* It is a portable inventory you generate on demand and hand to someone.
* **`.aspex.lock`** answers *what security-relevant state should stay stable?* You commit it, and [`aspex verify`](/tools/change-detection) fails when the environment drifts from it.

`aspex-asbom/v1` wraps the same `environment` object that `.aspex.lock` uses (`schema_version: 1`), so the two are the same data with different headers:

| Field                                   | Contents                                                                                                                                                                                                                                                      |
| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `agents`                                | clients found (Claude Code, Cursor, ...)                                                                                                                                                                                                                      |
| `mcp_servers[]`                         | name, client, command, args, url, config\_path, package, pinned, env\_keys (names only), identity, tools (name, description, schema\_hash), capabilities, filesystem\_roots, filesystem\_scope, egress\_open, destinations, agent\_state\_writes, fingerprint |
| `hooks[]`, `skills[]`, `instructions[]` | as in the lockfile; content hashed, never stored                                                                                                                                                                                                              |
| `sensitive_resources[]`                 | path, kind (credentials, agent-state, database, browser-profile), via, access                                                                                                                                                                                 |
| `destinations[]`                        | fixed hosts and "arbitrary https"                                                                                                                                                                                                                             |
| `attack_paths[]`                        | AP001-AP006 with evidence, steps, impact, remediation, confidence                                                                                                                                                                                             |
| `blast_radius`                          | level and every reason, present or absent                                                                                                                                                                                                                     |
| `static`                                | true when no server was launched                                                                                                                                                                                                                              |

No secret values appear anywhere in the document.

## CycloneDX

```sh theme={"dark"}
aspex bom --format cyclonedx > agent.cdx.json
```

A CycloneDX 1.5 JSON BOM for the subset that maps cleanly:

| Aspex                                                            | CycloneDX                                                                                                                                                                                                                     |
| ---------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| MCP server                                                       | `component` (type application) with `purl` when the package and pin are known (`pkg:npm/modelcontextprotocol/server-filesystem@0.6.2`), the surface fingerprint as a SHA-256 hash, fixed destinations as `externalReferences` |
| agent, hook, skill                                               | `component` with `aspex:kind` property; hooks and skills carry their content hash                                                                                                                                             |
| attack path                                                      | `vulnerability` rated by Aspex (source URL points at the project), `affects` the servers on the path, `recommendation` is the fix                                                                                             |
| capabilities, filesystem scope, egress, blast radius, confidence | `properties` (`aspex:*`), because the standard has no first-class field for them                                                                                                                                              |

The serial number is derived from the environment, so an unchanged setup produces the same serial. SPDX is not supported; it has no natural home for capabilities or paths. The native `aspex-asbom/v1` remains the authoritative form.