Software Bill of Materials (SBOMs) are essential for enterprise software, providing transparency into components and their origins. AI agents, however, currently lack this crucial verification mechanism. When an agent loads a capability from a GitHub repository, there's no way to confirm its implementation, supporting files, approval status, licensing, or security risks. This creates a significant trust gap in agent supply chains. HURCULES aims to fill this gap by acting as an SBOM-for-Agents. It functions as a deterministic compiler that analyzes repositories without executing code to identify capabilities. For each identified capability, HURCULES gathers file-level evidence and has a separate agent challenge its claims. A human must then review and approve the capability package. This process ensures provenance tracking, registering each capability with a unique ID, source, commit hash, and approval timestamp. For enterprises, HURCULES offers compliance, security, and trust by verifying capabilities' origins, licenses, and safety. Developers benefit from safely loading capabilities and understanding their implementation details. The ecosystem gains a standardized, interoperable, and trustworthy supply chain for agent capabilities. HURCULES is available as an open-source tool, with ongoing efforts to improve its extraction recall and expand its registry. Integration with agent runtimes and enterprise features are planned for the future.