docs(guides): add a guide for connecting AI agents over MCP - #114
Open
vpetersson-bot wants to merge 1 commit into
Open
docs(guides): add a guide for connecting AI agents over MCP#114vpetersson-bot wants to merge 1 commit into
vpetersson-bot wants to merge 1 commit into
Conversation
sbomify now runs a Model Context Protocol server, so agents can answer questions about a workspace directly rather than the user shuttling data between a browser and a chat window. Written for the person deciding whether to point an agent at their supply-chain data, so it leads with what you can actually ask, and is explicit about the part that deserves scrutiny: an agent reading your SBOMs is reading text your suppliers wrote, and their suppliers wrote. The security section says what protects you (scopes are the boundary; destructive tools are absent rather than disabled) and, just as plainly, what does not — nothing stops a determined injection from making an agent describe something misleadingly. Operator configuration (host allow-listing, resource caps, troubleshooting) stays in the application repo next to the code that reads those settings. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
vpetersson-bot
added a commit
to vpetersson-bot/sbomify
that referenced
this pull request
Jul 28, 2026
`docs/mcp.md` was serving two readers at once: someone connecting an agent (token scoping, client config, tool reference) and someone running the service (host allow-listing, resource caps, troubleshooting). Neither was well served by a page aimed at both, and the setup half belongs where users actually look — the website, not the application repository. The user-facing half moves to sbomify.com/guides/mcp/ (sbomify/sbomify.com#114). What stays here is the operator reference: the settings the endpoint reads, the audit log streams, what a 421 or a "Task group is not initialized" means, and the deployment constraints. Those live next to the code that reads them, so they change in the same commit when the code does. Deliberately not duplicated. Two copies of a 200-line page drift, and the copy in this repo is the one that gets updated when the code changes — leaving the website's copy quietly wrong for users, which is the worse failure. README, docs/access-tokens.md and AGENTS.md now point setup questions at the guide. AGENTS.md also notes that a change to the tool surface needs a PR in both repositories. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
/guides/mcp/— how to connect Claude and other AI agents to a sbomify workspace over theModel Context Protocol.
Pairs with sbomify/sbomify#1231, which adds the server itself. Worth holding until that merges,
since this describes a feature that is not live yet.
What's in it
Written for the person deciding whether to point an agent at their supply-chain data, so it leads
with what you can actually ask ("which components in the 2.4 release have critical vulnerabilities,
and which already have a VEX?") rather than with a tool list.
Covers token scoping, client setup for Claude Code and JSON-config clients, a connection check, the
available tools, and the security model.
On the security section
An agent reading your SBOMs is reading text your suppliers wrote — and their suppliers, all the way
down. That is the part of this feature a security-minded reader will want to poke at, so the guide
is explicit in both directions:
absent rather than disabled; everything is capped and logged), and
misleadingly, so an agent's summary of a third-party artifact deserves the same caution as the
artifact.
Understating that would be the wrong trade for a supply-chain security product.
Scope
Operator configuration — host allow-listing, resource caps, 421 and lifespan troubleshooting — stays
in the application repo next to the code that reads those settings, rather than being duplicated
here where it would drift.
Checks
bun run lintpasses (dprint + d2)hugo --minify --environment productionbuilds clean; page renders at/guides/mcp/content/guides/_index.mdunder Platform Guides🤖 Generated with Claude Code