#sbom

Create CycloneDX Software Bill of Materials (SBOM) from PHP Composer projects

Open-source security scanner with first-class AI app security (prompt injection, embedding leakage, agent over-privilege, MCP hardening). Polyglot AIBOM, SARIF, SBOM. Cosign-signed plugin marketplace. Offline-first, agent-native via MCP.

SBOM analysis platform for storing, correlating, and querying software bill of materials and security advisories (CSAF/VEX, OSV, CVE) at scale. Exposes a correlation graph of vuln :left_right_arrow: component :left_right_arrow: product :left_right_arrow: VEX

Go library to consume and produce CycloneDX Software Bill of Materials (SBOM)

Create CycloneDX Software Bill of Materials (SBOM) from Node.js Yarn projects.

:mag: ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet, the Google Summer of Code, Azure credits, nexB and other generous sponsors!

Open-source AI Bill of Materials (AIBOM) scanner: inventories AI models, datasets, prompts, embeddings, vector DBs & RAG pipelines across code, containers & Kubernetes — with file:line evidence, load-time risk detection (poisoned pickle / Keras Lambda / unsafe torch.load) and NIST AI RMF / OWASP compliance mapping. CycloneDX · SARIF · JSON.

Free, open-source CLI for dependency intelligence, SBOMs, vulnerability auditing, and CI policy gates.

Mix task to generate a Software Bill-of-Materials (SBoM) in CycloneDX format

Open-source AI code review engine + unified quality CLI orchestrating 15+ linters. CLI, GitHub Action, and MCP server.

Make production Rust binaries auditable

Security-first remote Docker agent — authenticated Docker API proxy with outbound edge mode, Ed25519 per-request auth, and a cosign-signed, scratch-based supply chain. Drydock-native + generic REST.

Creates CycloneDX Software Bill of Materials (SBOM) from Maven projects

JMo Security Suite - Terminal-first security audit toolkit with many tools, multi-target scanning, & compliance

Convert source code into a repository-scale structural model. Air gapped, zero dependencies, SARIF and SBOM outputs.

Create CycloneDX Software Bill of Materials (SBOM) from projects built with esbuild or Bun.

🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

Git diff for SBOMs—compare CycloneDX, SPDX, and Syft documents, detect tampering, and gate CI.

Synapse - a governed control plane for software composition analysis, recon, evidence, and reporting. Verify Everything. Trust Nothing.

A secure, high-performance, multi-tenant platform for remote App ”Hosting“ and ”Computing“

Unified CLI for software supply-chain governance / verify GitHub artifact attestations, evaluate OPA/Rego policies, generate SLSA Verification Summary Attestations (VSAs), and manage releases.

The SBOM tool is a highly scalable and enterprise ready tool to create SPDX 2.2 compatible SBOMs for any variety of artifacts.

.NET parser for Package URLs (ECMA-427)

CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions.

Rebar3 plugin to generate CycloneDX SBoM

Open-source post-quantum readiness tooling by quantakrypto

Typed, audited, zero-allocation-bound frontmatter parser for Rust — YAML/TOML/JSON extraction, SEO meta tag emission, supply-chain attested (cargo-vet, SBOM, RUSTSEC). WASI-bound roadmap.

.NET library to consume and produce CycloneDX Software Bill of Materials (SBOM)

Utility that provides an API platform for validating, querying and managing BOM data