#sbom

Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server

Scans your project to determine what components you use

Create CycloneDX Software Bill of Materials (SBOM) from PHP Composer projects

Functionality and DataModels of OWASP CycloneDX for Python

opensource repo for validating agentic AI applications: redteam, behavior, supply-chain, static analysis

This is a mirror of https://codeberg.org/fsfe/reuse-tool

Create SBOMs in CycloneDX format for your Vite, Rollup or Rolldown projects with ease

🎁 wraps all package managers with a unifying CLI

About standalone, Kubernetes-native Software Bill of Materials (SBOM) visualization and governance platform

CLI security scanner built for the agentic era. Detects CI/CD misconfigs, agent permission risks, MCP tool injection, hardcoded secrets, and DMCA-flagged AI dependencies.

JMo Security Suite - Terminal-first security audit toolkit with many tools, multi-target scanning, & compliance

Open-source security scanner with first-class AI app security (prompt injection, embedding leakage, agent over-privilege, MCP hardening). Polyglot AIBOM, SARIF, SBOM. Cosign-signed plugin marketplace. Offline-first, agent-native via MCP.

:mag: ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet, the Google Summer of Code, Azure credits, nexB and other generous sponsors!

Free, open-source CLI for dependency intelligence, SBOMs, vulnerability auditing, and CI policy gates.

A scalable server implementation of the OSS Review Toolkit.

Make production Rust binaries auditable

creates CycloneDX Software-Bill-of-Materials (SBOM) from Node.js-based projects

Making linters play nice... Mostly.

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

Deep repository intelligence for humans and ai. Air gapped, on premise, zero dependency SAST for 50 languages regardless of compilation status. Sarif and sbom outputs.

Security-first remote Docker agent — authenticated Docker API proxy with outbound edge mode, Ed25519 per-request auth, and a cosign-signed, scratch-based supply chain. Drydock-native + generic REST.

CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions.

.NET library to consume and produce CycloneDX Software Bill of Materials (SBOM)