aspex bom - Aspex

aspex bom                          # tree for humans
aspex bom --json > agent.asbom.json

  Agent: Claude Code

  MCP servers
  ├── filesystem  12 tools · file-read, file-write · sensitive scope
  ├── github  26 tools · external-send, untrusted-ingress, data-read
  └── playwright  21 tools · network-send, untrusted-ingress, browser

  Skills
  ├── deploy  project · runs commands
  └── use-spark  user · runs commands

  Hooks
  └── PostToolUse  INFO · /Users/steven/.claude/onyx/onyx-scanner

  Sensitive resources reachable
  ├── ~/.ssh  read-write via filesystem
  ├── ~/.aws  read-write via filesystem
  └── agent config, hooks, instructions, memory (9 files)  write via filesystem

  External destinations
  ├── arbitrary https
  └── github.com

  Attack paths
  └── 2 CRITICAL, 1 HIGH

  Blast radius: HIGH
     ✓ reads credentials or sensitive files
     ✓ arbitrary external network egress
     ✗ command execution
     ...

JSON schema

aspex bom and .aspex.lock are the same underlying environment model with different jobs:

aspex bom answers what constitutes this agent environment? It is a portable inventory you generate on demand and hand to someone.
.aspex.lock answers what security-relevant state should stay stable? You commit it, and aspex verify fails when the environment drifts from it.

aspex-asbom/v1 wraps the same environment object that .aspex.lock uses (schema_version: 1), so the two are the same data with different headers:

Field	Contents
`agents`	clients found (Claude Code, Cursor, …)
`mcp_servers[]`	name, client, command, args, url, config_path, package, pinned, env_keys (names only), identity, tools (name, description, schema_hash), capabilities, filesystem_roots, filesystem_scope, egress_open, destinations, agent_state_writes, fingerprint
`hooks[]`, `skills[]`, `instructions[]`	as in the lockfile; content hashed, never stored
`sensitive_resources[]`	path, kind (credentials, agent-state, database, browser-profile), via, access
`destinations[]`	fixed hosts and “arbitrary https”
`attack_paths[]`	AP001-AP006 with evidence, steps, impact, remediation, confidence
`blast_radius`	level and every reason, present or absent
`static`	true when no server was launched

No secret values appear anywhere in the document.

CycloneDX

aspex bom --format cyclonedx > agent.cdx.json

A CycloneDX 1.5 JSON BOM for the subset that maps cleanly:

Aspex	CycloneDX
MCP server	`component` (type application) with `purl` when the package and pin are known (`pkg:npm/modelcontextprotocol/server-filesystem@0.6.2`), the surface fingerprint as a SHA-256 hash, fixed destinations as `externalReferences`
agent, hook, skill	`component` with `aspex:kind` property; hooks and skills carry their content hash
attack path	`vulnerability` rated by Aspex (source URL points at the project), `affects` the servers on the path, `recommendation` is the fix
capabilities, filesystem scope, egress, blast radius, confidence	`properties` (`aspex:*`), because the standard has no first-class field for them

The serial number is derived from the environment, so an unchanged setup produces the same serial. SPDX is not supported; it has no natural home for capabilities or paths. The native aspex-asbom/v1 remains the authoritative form.