Go
anchore/syft
CLI tool and library for generating a Software Bill of Materials from container images and filesystems
Apache-2.0Aug 28, 2026 · metrics 2.10.0
All tags
Catalogue tag
#cyclonedx
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
46 records
Go
chainloop-dev/chainloop
SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more
Apache-2.0Sep 9, 2026 · metrics 2.10.0
PyPI
CycloneDX/cyclonedx-python-lib
Functionality and DataModels of OWASP CycloneDX for Python
Apache-2.0Sep 9, 2026 · metrics 2.10.0
Go
anchore/grype
A vulnerability scanner for container images and filesystems
Apache-2.0Aug 27, 2026 · metrics 2.10.0
PyPI
CycloneDX/cyclonedx-python
CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments
Apache-2.0Aug 27, 2026 · metrics 2.10.0
Go
guacsec/guac
GUAC aggregates software security metadata into a high fidelity graph database.
Apache-2.0Oct 19, 2026 · metrics 2.10.0
Maven · npm
oss-review-toolkit/ort
A suite of tools to automate software compliance checks.
Apache-2.0Sep 9, 2026 · metrics 2.10.0
Maven
CycloneDX/cyclonedx-core-java
CycloneDX SBOM Model and Utils for Creating and Validating BOMs
Apache-2.0Oct 19, 2026 · metrics 2.10.0
npm
CycloneDX/cyclonedx-node-npm
Create CycloneDX Software Bill of Materials (SBOM) from Node.js NPM projects.
Apache-2.0Sep 15, 2026 · metrics 2.10.0
NuGet
CycloneDX/cyclonedx-dotnet
Creates CycloneDX Software Bill of Materials (SBOM) from .NET Projects
Apache-2.0Oct 11, 2026 · metrics 2.10.0
npm · PyPI
CycloneDX/cyclonedx-javascript-library
Functionality and DataModels of OWASP CycloneDX for JavaScript (Node.js or WebBrowser) written in TypeScript.
Apache-2.0Sep 18, 2026 · metrics 2.10.0
npm · Maven · NuGet +1
cdxgen/cdxgen
Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server
Apache-2.0Sep 14, 2026 · metrics 2.10.0
Packagist · PyPI
CycloneDX/cyclonedx-php-library
Functionality and DataModels of OWASP CycloneDX for PHP
Apache-2.0Sep 18, 2026 · metrics 2.10.0
PyPI
kdeldycke/meta-package-manager
🎁 snapshot every package on your machine to one file, restore it on a new one
GPL-2.0Sep 12, 2026 · metrics 2.10.0
npm
CycloneDX/cyclonedx-webpack-plugin
Generate CycloneDX Software Bill of Materials (SBOM) from webpack bundles at compile time.
Apache-2.0Sep 15, 2026 · metrics 2.10.0
Maven · npm
eclipse-apoapsis/ort-server
A scalable server implementation of the OSS Review Toolkit.
Apache-2.0Sep 8, 2026 · metrics 2.10.0
npm
janbiasi/rollup-plugin-sbom
Create SBOMs in CycloneDX format for your Vite, Rollup or Rolldown projects with ease
MITSep 9, 2026 · metrics 2.10.0
—
package-url/purl-spec
A minimal specification for purl aka. a package "mostly universal" URL, join the discussion at https://gitter.im/package-url/Lobby
Custom licenseOct 19, 2026 · metrics 2.10.0
Packagist
CycloneDX/cyclonedx-php-composer
Create CycloneDX Software Bill of Materials (SBOM) from PHP Composer projects
Apache-2.0Sep 14, 2026 · metrics 2.10.0
npm
CycloneDX/cyclonedx-node-yarn
Create CycloneDX Software Bill of Materials (SBOM) from Node.js Yarn projects.
Apache-2.0Sep 15, 2026 · metrics 2.10.0
PyPI
aboutcode-org/scancode-toolkit
:mag: ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet, the Google Summer of Code, Azure credits, nexB and other generous sponsors!
Custom licenseSep 12, 2026 · metrics 2.10.0
Go
airomhq/airom
Open-source AI Bill of Materials (AIBOM) scanner: inventories AI models, datasets, prompts, embeddings, vector DBs & RAG pipelines across code, containers & Kubernetes — with file:line evidence, load-time risk detection (poisoned pickle / Keras Lambda / unsafe torch.load) and NIST AI RMF / OWASP compliance mapping. CycloneDX · SARIF · JSON.
Apache-2.0Sep 13, 2026 · metrics 2.10.0
npm · Go · PyPI
bomly-dev/bomly-cli
Free, open-source CLI for dependency intelligence, SBOMs, vulnerability auditing, and CI policy gates.
Apache-2.0Sep 10, 2026 · metrics 2.10.0
Hex
erlef/mix_sbom
Mix task to generate a Software Bill-of-Materials (SBoM) in CycloneDX format
Custom licenseSep 9, 2026 · metrics 2.10.0
Maven
CycloneDX/cyclonedx-maven-plugin
Creates CycloneDX Software Bill of Materials (SBOM) from Maven projects
Apache-2.0Sep 14, 2026 · metrics 2.10.0
npm
CycloneDX/cyclonedx-esbuild
Create CycloneDX Software Bill of Materials (SBOM) from projects built with esbuild or Bun.
Apache-2.0Sep 15, 2026 · metrics 2.10.0
PyPI
cpeoples/ansible-security-scanner
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
Apache-2.0Sep 9, 2026 · metrics 2.10.0
PyPI · npm
owasp-dep-scan/dep-scan
OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.
MITSep 18, 2026 · metrics 2.10.0
Go
rezmoss/sbomlyze
Git diff for SBOMs—compare CycloneDX, SPDX, and Syft documents, detect tampering, and gate CI.
Apache-2.0Sep 12, 2026 · metrics 2.10.0
Go · npm · PyPI
KKloudTarus/synapse-ce
Synapse - a governed control plane for software composition analysis, recon, evidence, and reporting. Verify Everything. Trust Nothing.
Apache-2.0Sep 17, 2026 · metrics 2.10.0