site-docs/privacy.md

Rama main · réplica de lectura del repositorio original.

# Privacy notice

Last updated: 2026-11-06.

This notice covers the agent-bom software and its directory plugins, which run on
your machine. The agent-bom project offers no public hosted service, and these tools
send the project no data. Anyone who runs agent-bom as a service for others is its
operator, and that operator's own notice applies to what they store.

## Scope and information processed

agent-bom is security scanning software that can run locally or in an
operator-controlled service. These modes have different data boundaries.

Local directory plugins run selected inventory, package, configuration and skill
checks. Depending on the requested tool, inputs include package names and
versions, selected file paths and contents, MCP server definitions, environment
variable names, vulnerability identifiers and findings. Discovery can read known
client configuration locations; preview them with `agent-bom where --dry-run`.
Directory skills and the audit profile do not expose the `agent_activity` tool
or a skill for reading chat history. Other explicitly selected standalone
features have their own permissions; installing a directory plugin does not
authorize them.

The agent-bom-guard plugin adds one hook. Claude Code passes it the text of
every Bash command before it runs, and it parses that text on your machine to
find package installs. It stores nothing and writes no files. With its `osv_lookup`
option on, which is the default, it sends the name, ecosystem and pinned version of
each package an install names to `api.osv.dev`, even when the install uses a custom
registry, so a private package name reaches that service unless the option is off.
It sends no command text, paths, file contents, environment variables or credentials.

No directory plugin reads Claude or Codex chat history, session files or memory.
`~/.claude.json` is read for its MCP server entries; the prompt history it also holds
is not used or returned.

A remote MCP service receives the tool name and arguments sent by the client,
including any supplied paths, package names or evidence, and returns tool
results to that client. Remote paths refer to the server's filesystem, not the
client's computer. The client and its AI provider may retain those messages
under their own policies. Do not submit secrets or personal information that
the selected scan does not require. Redaction reduces exposure but is not a
guarantee that arbitrary input is free of sensitive information.

## Destinations

Package and vulnerability lookups can send package names, versions, advisory
IDs and repository coordinates to OSV, NVD, FIRST EPSS, CISA, npm, PyPI and
OpenSSF Scorecard. Installation through `uvx` downloads software from the
configured package index. These providers also receive ordinary network
request metadata. The scanner's lookup requests do not upload entire project
files. Offline scanning uses available local evidence and can have coverage gaps.

Refreshing the local advisory database, which no directory skill does on its own,
downloads public feeds from `osv-vulnerabilities.storage.googleapis.com`,
`secdb.alpinelinux.org`, `security-tracker.debian.org`, `deb.freexian.com`,
`epss.empiricalsecurity.com`, CISA and NVD, and sends no package or project data.

The agent-bom Claude plugin starts its servers with `GITHUB_TOKEN`, `GH_TOKEN` and
`NVD_API_KEY` blanked. When agent-bom runs from a shell, as the Codex skills do, a
`GITHUB_TOKEN` or `GH_TOKEN` already in that environment is sent only to
`api.github.com`, and `NVD_API_KEY` only to `services.nvd.nist.gov`, to raise rate limits.

Hosted OAuth sends users to the configured authorization server for login and
consent. The MCP service validates the access token's issuer, subject, tenant,
audience and expiry, then sends that token to the same issuer's configured
introspection endpoint to check whether it remains active. Passwords are
entered at the authorization server; the MCP service does not implement a
password-login form. Authentication, hosting and identity-provider logs are
subject to those operators' configurations.

Explicitly configured control-plane pushes, exports, cloud connectors, webhooks
and telemetry collectors have separate destinations and permissions. They are
not enabled by installing a directory skill. The
[permissions contract](https://github.com/koda-ai-studio/agent-bom/blob/main/docs/PERMISSIONS.md)
lists the supported destinations and opt-in behavior.

## Storage and retention

- Local report files remain until the user or an operator removes them.
  Local rescan summaries retain one bounded identity summary per target, up to
  200 targets by default; `AGENT_BOM_NO_SCAN_MEMORY=1` disables that feature.
- The MCP scan-result store uses SQLite or configured PostgreSQL. Its default
  readable lifetime is **30 minutes**, configurable by
  `AGENT_BOM_MCP_SCAN_RESULT_TTL_SECONDS`, with four results per tenant by
  default. Expired rows are removed when a subsequent result is stored;
  expiration is **not a guaranteed deletion deadline** for database files,
  backups or replicas. Cached results are bound to a tenant and caller token;
  token rotation prevents access to the preceding token's cached results.
- Recent MCP request traces are held in process memory, bounded to 256 entries
  by default. Operational logs, persisted inventory, audit records and backups
  have operator-controlled retention. This code does not impose one universal
  deletion period on every deployment or external provider.
- The resource server caches public verification keys for five minutes. It
  checks token activity on each HTTP authentication request without caching a
  successful introspection decision. Client-side refresh-token storage belongs
  to the MCP client and authorization server.

The operator of a hosted or self-hosted deployment sets its log, backup and
identity-account retention, and must document those settings and its deletion process.

## Purposes and your controls

The information above is processed only to produce the security result you asked for.
There is no telemetry, advertising or profiling in the plugins. You can preview what
is read with `agent-bom where --dry-run`, turn off network lookups with offline mode or
the guard's `osv_lookup` option, turn off rescan summaries with
`AGENT_BOM_NO_SCAN_MEMORY=1`, and delete local data by removing `~/.agent-bom`.

## Access and questions

The project holds no records about you from these tools. For data stored by a hosted
or self-hosted deployment, contact its operator. Use the project's
[support channel](https://github.com/koda-ai-studio/agent-bom/issues) for general
questions without including private records. Report security concerns through
[the private reporting instructions](https://github.com/koda-ai-studio/agent-bom/security/policy).
No certification or regulatory compliance status is asserted by this notice.