# SBOM Dependency Risk Scorer MCP for AI Agents MCP

> SBOM Dependency Risk Scorer helps you turn raw SBOM files into actionable risk assessments. It parses SPDX and CycloneDX files to find outdated packages, count CVEs, and map out complex dependency trees. Instead of guessing where your software's weak points are, you get a clear risk score to prioritize your security fixes.

## Overview
- **Category:** security
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_KlPJrIwRzxzKDRHQ287k2q0iQyXI2BLIopz2ESTV/mcp
- **Tags:** sbom, vulnerability, dependency-analysis, cve, risk-assessment

## Description

Managing software supply chain risk feels like looking for a needle in a haystack, especially when you're dealing with hundreds of transitive dependencies. This MCP changes that by letting your AI client actually read the risk into your project. Instead of just listing what's in your software, it digs into the health of those components. It looks for staleness, which are those packages that haven't been updated in years, and maps out how deep your dependency tree actually goes. It then ties everything together by counting known vulnerabilities and spitting out a single, clear risk score. This means you can stop manually cross-referencing CVE databases and start focusing on the components that actually need attention. If you're looking for a way to make sense of complex software bills of materials, this is the tool to add to your Vinkius catalog to get your security team moving faster.

## Tools

### analyze_dependency_structure
Maps out the depth and complexity of your software's dependency tree. It helps you see how many nested libraries are being pulled into your project.

### calculate_composite_risk_score
Produces a single, actionable score that summarizes the overall risk of the SBOM. This gives you a high-level view of your security posture.

### evaluate_package_stalness
Evaluates how outdated packages are based on release dates

### tally_vulnerability_exposure
Scans the SBOM to count every known CVE associated with your current dependencies. This provides a clear count of your total vulnerability surface area.

## Prompt Examples

**Prompt:** 
```
Look at this SBOM and tell me the top 3 biggest security risks.
```

**Response:** 
```
### High Priority Risks
Based on the analysis, these are your top 3 concerns:

| Package | Issue | Risk Level |
| :--- | :--- | :--- |
| `lib-auth-v2` | 14 Known CVEs | **Critical** |
| `data-parser` | Not updated since 2018 | **High** |
| `json-utils` | 3 Known CVEs | **Medium** |

**Summary:** Your highest risk is `lib-auth-v2` due to a high density of active vulnerabilities.
```

**Prompt:** 
```
How many layers deep is my dependency tree?
```

**Response:** 
```
Your dependency tree has a **direct-to-transitive ratio of 0.15**. 

This means for every 1 library you install directly, there are roughly 6.6 nested dependencies. This indicates a high level of structural complexity that could make patching difficult.
```

**Prompt:** 
```
Give me a risk score for this project.
```

**Response:** 
```
### Project Risk Assessment
**Overall Score: High**

*   **Vulnerability Count:** 27 total CVEs
*   **Staleness:** 40% of packages are over 2 years out of date.
*   **Complexity:** High transitive depth.

**Recommendation:** Focus on updating `lib-auth-v2` and `data-parser` immediately to lower your composite risk score.
```

## Capabilities

### Map out dependency trees
Visualizes the depth and complexity of your software's nested dependencies.

### Identify outdated packages
Flags libraries that haven't been updated by maintainers in a long time.

### Count known CVEs
Aggregates the total number of known vulnerabilities across your entire SBOM.

### Generate a final risk score
Provides a single, actionable score to rank the security health of a project.

### Parse SPDX and CycloneDX files
Reads standard software bill of materials formats to extract security data.

## Use Cases

### Prioritizing a massive security backlog
A security engineer finds a 500-line SBOM and needs to know where to start. They ask the agent to calculate the risk score and list the top 5 most stale packages.

### Checking the impact of a new library
A developer wants to know if adding a new library is safe. They use the tool to analyze the dependency structure to see how many new transitive dependencies it pulls in.

### Generating a compliance summary
A compliance team needs a high-level risk summary for a report. The agent runs the risk scorer and summarizes the findings into a simple High, Medium, or Low status.

### Assessing widespread CVE exposure
A team is worried about a specific CVE. They use the tool to tally the total vulnerability exposure across all projects to see if it's widespread.

## Benefits

- Stop guessing which dependencies matter most by using calculate_composite_risk_score to prioritize your work.
- Spot zombie code early with evaluate_package_stalness to find libraries that haven't been updated in years.
- Understand your transitive risk by using analyze_dependency_structure to see how deep your dependencies go.
- Get a fast count of your total CVE surface area using tally_vulnerability_exposure instead of manual searching.
- Standardize your security audits by processing both SPDX and CycloneDX formats through a single interface.

## How It Works

The bottom line is you turn a messy list of software components into a prioritized security to-do list.

1. Point your AI client to an SPDX or CycloneDX file.
2. Have the agent run the risk analysis tools to check for staleness and structure.
3. Get a prioritized list of high-risk components and a final composite score.

## Frequently Asked Questions

**What does the SBOM Dependency Risk Scorer actually do?**
It turns raw software bill of materials into a prioritized security report. It identifies which libraries are outdated, counts their vulnerabilities, and gives you a score to help you decide what to fix first.

**Can it handle different types of SBOM files?**
Yes, it supports both SPDX and CycloneDX formats. You can provide either type of file and the tool will parse the data to perform its risk analysis.

**How does it determine what is risky?**
It looks at three main factors: how many known vulnerabilities (CVEs) a package has, how long it has been since its last update, and how complex the dependency tree is.

**Is this for real-time monitoring?**
No, this is for static file analysis. It is designed to help you audit and score SBOM files rather than monitoring live network traffic or production servers.

**How does this help with software supply chain security?**
It helps you move from reactive to proactive security. By identifying the highest-risk components first, your team can allocate resources more effectively to patch the most dangerous parts of your software stack.

**Can I use this for SOC2 compliance?**
Yes, it's a great tool for compliance audits. It provides a clear, quantifiable way to demonstrate that you are monitoring and managing risks within your software supply chain.

**What types of SBOM formats are supported?**
The engine supports both SPDX and CycloneDX formats for analyzing dependency structures.

**How is the final risk score calculated?**
The `calculate_composite_risk_score` tool aggregates metrics from structural complexity, package staleness, and vulnerability counts to produce a normalized risk level.

**Can I use this to find outdated packages?**
Yes, by using the `evaluate_package_stalness` tool with a reference date, you can identify components that have not been updated recently.