https://openaca.dev/blog/ Notes on Agent Composition Analysis — identity resolution, Agent BOMs, and securing AI agent stacks. en-us https://openaca.dev/blog/what-is-an-ai-bom https://openaca.dev/blog/what-is-an-ai-bom Mon, 29 Jun 2026 00:00:00 GMT AI-BOMs list models or systems. Agent BOMs explain how plugins, skills, MCP servers, and packages are wired together — and where risk flows through that wiring. https://openaca.dev/blog/your-agent-risk-is-in-the-composition https://openaca.dev/blog/your-agent-risk-is-in-the-composition Tue, 23 Jun 2026 00:00:00 GMT Your SCA scanner can find vulnerable packages. It can't tell you those packages are wired into an AI agent that reads your chat messages, sends files, and is governed by skills that can rewrite its access policy. https://openaca.dev/blog/introducing-openaca https://openaca.dev/blog/introducing-openaca Tue, 16 Jun 2026 00:00:00 GMT Your dependency scanner can't see your agent stack. OpenACA is an open-source scanner that inventories the MCP servers, plugins, skills, and dependencies your AI agents pull in — and matches them against known security advisories.