What is an Agent Capability Bill of Materials (ACBOM)?

Why agents need a different kind of inventory

An SBOM answers which packages are inside. For an agent, the more urgent question is which actions are reachable: which tools it can call, which data those tools can read or write, which outside parties they can contact, and which other agents it can hand work to.

What an ACBOM contains

A useful ACBOM is built from the configuration that actually defines the agent:

• Agents and agent hosts, such as your own agents and coding agents like Claude Code or Codex.
• Tools and MCP servers, with what each can do.
• Identities and permissions the tools act as.
• Delegation: which agents can call which other agents.
• Hooks, permission rules, plugins, skills, and workflows that grant authority.
• Where each item was declared, so every entry points back to a file and line.

How teams use one

Teams use an ACBOM as the baseline for review: generate it, approve it, then compare every pull request against it. The diff between two ACBOMs is the change in authority, which is what a security reviewer needs to see. The same inventory feeds audit evidence and an organization-wide view of which repositories let which agents do what.

Generate one with ControlLoop

The ControlLoop CLI is free and open source. It reads MCP, A2A, OpenAPI, OASF, IAM, and coding-agent configuration, writes an ACBOM, and gates changes against a baseline locally or in CI, with JSON and SARIF output and no network access required.