agent-bom AI Supply Chain
Connecting...
agent-bom
Connecting...

Trace review

# Runtime tool-call correlation

Review OTLP traces against vulnerable packages and servers already known to agent-bom. This page is for inspection and replay. Production collectors should send OTLP JSON to `POST /v1/traces`.

Input
OTLP JSON export
Paste, upload, or send directly from a collector.
Output
Flagged tool calls
Server, package, CVE, and severity correlation.

## Trace intake

Use a real OTLP export or the sample payload for a quick validation run.

Upload JSON
{ "resourceSpans": [ { "scopeSpans": [ { "spans": [ { "name": "adk.tool.call", "attributes": [ { "key": "tool.name", "value": { "stringValue": "query_db" } }, { "key": "mcp.server", "value": { "stringValue": "sqlite-mcp" } }, { "key": "package.name", "value": { "stringValue": "sqlite-utils" } } ] } ] } ] } ] }

Endpoint: `POST /v1/traces`

## Correlation result

Review flagged calls with mapped server, package, and CVE context.

No trace run yet.

Submit a payload to validate correlation against known vulnerable assets.