{ "bomFormat": "CycloneDX", "specVersion": "1.7", "serialNumber": "urn:uuid:fc0b95d9-fae8-4804-b6a2-055566079727", "version": 1, "metadata": { "timestamp": "2026-11-08T15:50:32Z", "tools": { "components": [ { "group": "@cyclonedx", "name": "cdxgen", "version": "12.9.1", "purl": "pkg:npm/%40cyclonedx/cdxgen@12.9.1", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.9.1", "publisher": "OWASP Foundation", "authors": [ { "name": "OWASP Foundation" } ] } ] }, "authors": [ { "name": "OWASP Foundation" } ], "lifecycles": [ { "phase": "pre-build" } ], "component": { "name": "agents", "group": "", "version": "0.13.3", "description": "A home for your AI agents", "purl": "pkg:npm/agents@0.13.3", "bom-ref": "pkg:npm/agents@0.13.3", "author": "Cloudflare Inc.", "properties": [ { "name": "cdx:npm:bin", "value": "agents" }, { "name": "cdx:npm:has_binary", "value": "true" }, { "name": "cdx:npm:scripts", "value": "build, evals, test, test:cli, test:react, test:browser, test:workers, test:chat, test:webmcp, test:x402, test:e2e" }, { "name": "cdx:npm:buildScripts", "value": "build" }, { "name": "cdx:license:category", "value": "Permissive" } ], "type": "application", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "externalReferences": [ { "type": "vcs", "url": "git+https://github.com/cloudflare/agents.git" } ] }, "properties": [ { "name": "cdx:bom:componentTypes", "value": "npm" }, { "name": "cdx:bom:componentSrcFiles", "value": "node_modules/ansi-regex/package.json\\nnode_modules/ansi-styles/package.json\\nnode_modules/cliui/package.json\\nnode_modules/emoji-regex/package.json\\nnode_modules/string-width/package.json\\nnode_modules/strip-ansi/package.json\\nnode_modules/wrap-ansi/package.json\\nnode_modules/yargs-parser/package.json\\nnode_modules/yargs/package.json" } ] }, "components": [ { "authors": [ { "name": "Ben Coe " } ], "group": "", "name": "yargs-parser", "version": "22.0.0", "description": "the mighty option parser used by yargs", "scope": "optional", "licenses": [ { "license": { "id": "ISC", "url": "https://opensource.org/licenses/ISC", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/yargs-parser@22.0.0", "externalReferences": [ { "type": "vcs", "url": "https://github.com/yargs/yargs-parser.git" } ], "type": "library", "bom-ref": "pkg:npm/yargs-parser@22.0.0", "properties": [ { "name": "SrcFile", "value": "node_modules/yargs-parser/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/yargs-parser/package.json" } ], "concludedValue": "node_modules/yargs-parser/package.json" } ] }, "tags": [ "parse" ] }, { "group": "", "name": "yargs", "version": "18.0.0", "description": "yargs the modern, pirate-themed, successor to optimist.", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/yargs@18.0.0", "externalReferences": [ { "type": "website", "url": "https://yargs.js.org/" }, { "type": "vcs", "url": "https://github.com/yargs/yargs.git" } ], "type": "library", "bom-ref": "pkg:npm/yargs@18.0.0", "properties": [ { "name": "SrcFile", "value": "node_modules/yargs/package.json" }, { "name": "ImportedModules", "value": "yargs,yargs/helpers,hideBin,yargs/helpers/hideBin" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/yargs/package.json" } ], "concludedValue": "node_modules/yargs/package.json" } ], "occurrences": [ { "location": "dist/cli/index.js", "line": 2 }, { "location": "dist/cli/index.js", "line": 3 }, { "location": "dist/cli/index.js", "line": 6 }, { "location": "src/cli/create.ts", "line": 1 }, { "location": "src/cli/create.ts", "line": 2 }, { "location": "src/cli/create.ts", "line": 5 } ] } }, { "authors": [ { "name": "Sindre Sorhus (https://sindresorhus.com)" } ], "group": "", "name": "wrap-ansi", "version": "9.0.2", "description": "Wordwrap a string with ANSI escape codes", "scope": "optional", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/wrap-ansi@9.0.2", "type": "library", "bom-ref": "pkg:npm/wrap-ansi@9.0.2", "properties": [ { "name": "SrcFile", "value": "node_modules/wrap-ansi/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/wrap-ansi/package.json" } ], "concludedValue": "node_modules/wrap-ansi/package.json" } ] }, "tags": [ "escape" ] }, { "authors": [ { "name": "Sindre Sorhus (https://sindresorhus.com)" } ], "group": "", "name": "strip-ansi", "version": "7.2.0", "description": "Strip ANSI escape codes from a string", "scope": "optional", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/strip-ansi@7.2.0", "type": "library", "bom-ref": "pkg:npm/strip-ansi@7.2.0", "properties": [ { "name": "SrcFile", "value": "node_modules/strip-ansi/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/strip-ansi/package.json" } ], "concludedValue": "node_modules/strip-ansi/package.json" } ] }, "tags": [ "escape" ] }, { "authors": [ { "name": "Sindre Sorhus (https://sindresorhus.com)" } ], "group": "", "name": "string-width", "version": "7.2.0", "description": "Get the visual width of a string - the number of columns required to display it", "scope": "optional", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/string-width@7.2.0", "type": "library", "bom-ref": "pkg:npm/string-width@7.2.0", "properties": [ { "name": "SrcFile", "value": "node_modules/string-width/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/string-width/package.json" } ], "concludedValue": "node_modules/string-width/package.json" } ] } }, { "authors": [ { "name": "Mathias Bynens (https://mathiasbynens.be/)" } ], "group": "", "name": "emoji-regex", "version": "10.6.0", "description": "A regular expression to match all Emoji-only symbols as per the Unicode Standard.", "scope": "optional", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/emoji-regex@10.6.0", "externalReferences": [ { "type": "website", "url": "https://mths.be/emoji-regex" }, { "type": "vcs", "url": "https://github.com/mathiasbynens/emoji-regex.git" } ], "type": "library", "bom-ref": "pkg:npm/emoji-regex@10.6.0", "properties": [ { "name": "SrcFile", "value": "node_modules/emoji-regex/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/emoji-regex/package.json" } ], "concludedValue": "node_modules/emoji-regex/package.json" } ] } }, { "authors": [ { "name": "Ben Coe " } ], "group": "", "name": "cliui", "version": "9.0.1", "description": "easily create complex multi-column command-line-interfaces", "scope": "optional", "licenses": [ { "license": { "id": "ISC", "url": "https://opensource.org/licenses/ISC", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/cliui@9.0.1", "type": "library", "bom-ref": "pkg:npm/cliui@9.0.1", "properties": [ { "name": "SrcFile", "value": "node_modules/cliui/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/cliui/package.json" } ], "concludedValue": "node_modules/cliui/package.json" } ] } }, { "authors": [ { "name": "Sindre Sorhus (https://sindresorhus.com)" } ], "group": "", "name": "ansi-styles", "version": "6.2.3", "description": "ANSI escape codes for styling strings in the terminal", "scope": "optional", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/ansi-styles@6.2.3", "type": "library", "bom-ref": "pkg:npm/ansi-styles@6.2.3", "properties": [ { "name": "SrcFile", "value": "node_modules/ansi-styles/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/ansi-styles/package.json" } ], "concludedValue": "node_modules/ansi-styles/package.json" } ] }, "tags": [ "escape" ] }, { "authors": [ { "name": "Sindre Sorhus (https://sindresorhus.com)" } ], "group": "", "name": "ansi-regex", "version": "6.2.2", "description": "Regular expression for matching ANSI escape codes", "scope": "optional", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/ansi-regex@6.2.2", "type": "library", "bom-ref": "pkg:npm/ansi-regex@6.2.2", "properties": [ { "name": "SrcFile", "value": "node_modules/ansi-regex/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/ansi-regex/package.json" } ], "concludedValue": "node_modules/ansi-regex/package.json" } ] }, "tags": [ "escape" ] } ], "dependencies": [], "annotations": [ { "bom-ref": "metadata-annotations", "subjects": [ "pkg:npm/agents@0.13.3" ], "annotator": { "component": { "group": "@cyclonedx", "name": "cdxgen", "version": "12.9.1", "purl": "pkg:npm/%40cyclonedx/cdxgen@12.9.1", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.9.1", "publisher": "OWASP Foundation", "authors": [ { "name": "OWASP Foundation" } ] } }, "timestamp": "2026-11-08T15:50:32Z", "text": "This Software Bill-of-Materials (SBOM) document was created on Sunday, November 8, 2026 with cdxgen. The data was captured during the pre-build lifecycle phase without building the application. The document describes an application named 'agents' with version '0.13.3'." } ] }