# Open Agent Model

> An open-source modeling language and static risk scanner for secure AI agents, MCP servers, and A2A integrations. Model agent boundaries before they act.

- **Type:** MCP server
- **Install:** `agentstack add mcp-yashitkumarsingh-open-agent-model`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [yashitkumarsingh](https://agentstack.voostack.com/s/yashitkumarsingh)
- **Installs:** 0
- **Category:** [Integrations](https://agentstack.voostack.com/c/integrations)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [yashitkumarsingh](https://github.com/yashitkumarsingh)
- **Source:** https://github.com/yashitkumarsingh/open-agent-model
- **Website:** https://github.com/yashitkumarsingh/open-agent-model

## Install

```sh
agentstack add mcp-yashitkumarsingh-open-agent-model
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# OpenAgentModel (oam)

> **Model your agents before they act.**
> An open Agent-BOM, threat model, and CI policy gate for AI agents and MCP-connected systems.

---

[](docs/cli-usage.md)
[](docs/concepts.md)
[](LICENSE)

OpenAgentModel is an open-source modeling language for declaring an Agent-BOM and enforcing static security checks before AI agent systems reach production.

Rather than checking runtime behaviors alone, OpenAgentModel allows security, risk, and engineering teams to declare agents, tools, models, identities, MCP servers, data classes, approvals, and policies statically. The CLI validates referential completeness, evaluates loop/escalation risks, exports SARIF, and blocks risky pull requests in CI.

---

## Technical Documentation Guide

To keep the documentation clean and developer-friendly, the specifications are divided into logical, modular guides:

1. **[Core Concepts & Threat Models](docs/concepts.md)**
   - Explains the model-first wedge, security context flows, and Agent-BOM contract.
   - Maps checks to **OWASP Top 10 for LLM Applications 2025** and emerging agentic application security patterns.
2. **[CLI Installation & Usage Guide](docs/cli-usage.md)**
   - Walkthrough of standard commands (`init`, `validate`, `diagram`, `risk`, `report`).
   - Schema field reference and GitHub Actions blocking gates via **SARIF** logs.
3. **[Built-In Rule Catalog](docs/rule-catalog.md)**
   - Documents risk rule IDs, severity, intent, and the current static-analysis scope.
4. **[10 Diverse Reference Scenarios](docs/examples.md)**
   - Copy-pasteable configuration templates matching e-commerce, healthcare, code evaluation, smart home, and supply chain topologies.
5. **[Enterprise v1.0 Roadmap](docs/roadmap.md)**
   - Outlines future features: LangGraph/CrewAI AST code importers, Sugiyama graph crossing minimization, and OpenTelemetry trace checking.
6. **[Testing Guide](TESTING.md)**
   - Lists the local Node 22 test workflow and current test coverage map.
7. **[Known Limitations](docs/known-limitations.md)**
   - Calls out current static-analysis, SARIF, MCP, and drift-detection boundaries.
8. **[Schema Versioning](docs/schema-versioning.md)**
   - Explains how schema and Agent-BOM version metadata are managed.
9. **[Release Process](docs/release-process.md)**
   - Documents the current manual release checklist and future automation target.

---

## Quick Start
```bash
# Use the pinned runtime
nvm use

# Install and build
npm install
npm run build
npm link

# Initialize config
oam init -o agentmodel.yaml

# Run validation and linker check
oam validate -i agentmodel.yaml

# Evaluate static risks
oam risk -i agentmodel.yaml --fail-on high

# Export complete HTML dashboard and Rego-style policy examples
oam report -i agentmodel.yaml -d reports/

# Compare runtime OpenTelemetry traces against design spec to find drift
oam drift -i agentmodel.yaml -t traces.json
```

---

## CI/CD Integration Gate

OpenAgentModel is designed to enforce security gates automatically inside pull requests. You can see our active workflow configuration in [.github/workflows/agent-governance.yml](.github/workflows/agent-governance.yml).

To integrate the risk scanner check into your own repository's workflow:

```yaml
name: Agent Governance Gate
on: [pull_request]

jobs:
  validate-agents:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - run: npm install -g open-agent-model
      - name: Validate Model Integrity
        run: oam validate -i agentmodel.yaml
      - name: Enforce Security Threshold
        run: oam risk -i agentmodel.yaml --fail-on high --sarif agent-risks.sarif
```

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [yashitkumarsingh](https://github.com/yashitkumarsingh)
- **Source:** [yashitkumarsingh/open-agent-model](https://github.com/yashitkumarsingh/open-agent-model)
- **License:** Apache-2.0
- **Homepage:** https://github.com/yashitkumarsingh/open-agent-model

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-yashitkumarsingh-open-agent-model
- Seller: https://agentstack.voostack.com/s/yashitkumarsingh
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.