#cyclonedx

CycloneDX SBOM Model and Utils for Creating and Validating BOMs

Create CycloneDX Software Bill of Materials (SBOM) from Node.js NPM projects.

Creates CycloneDX Software Bill of Materials (SBOM) from .NET Projects

Functionality and DataModels of OWASP CycloneDX for JavaScript (Node.js or WebBrowser) written in TypeScript.

Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server

Functionality and DataModels of OWASP CycloneDX for PHP

🎁 snapshot every package on your machine to one file, restore it on a new one

Generate CycloneDX Software Bill of Materials (SBOM) from webpack bundles at compile time.

A scalable server implementation of the OSS Review Toolkit.

Create SBOMs in CycloneDX format for your Vite, Rollup or Rolldown projects with ease

A minimal specification for purl aka. a package "mostly universal" URL, join the discussion at https://gitter.im/package-url/Lobby

Create CycloneDX Software Bill of Materials (SBOM) from PHP Composer projects

Create CycloneDX Software Bill of Materials (SBOM) from Node.js Yarn projects.

:mag: ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet, the Google Summer of Code, Azure credits, nexB and other generous sponsors!

Open-source AI Bill of Materials (AIBOM) scanner: inventories AI models, datasets, prompts, embeddings, vector DBs & RAG pipelines across code, containers & Kubernetes — with file:line evidence, load-time risk detection (poisoned pickle / Keras Lambda / unsafe torch.load) and NIST AI RMF / OWASP compliance mapping. CycloneDX · SARIF · JSON.

Free, open-source CLI for dependency intelligence, SBOMs, vulnerability auditing, and CI policy gates.

Mix task to generate a Software Bill-of-Materials (SBoM) in CycloneDX format

Creates CycloneDX Software Bill of Materials (SBOM) from Maven projects

Create CycloneDX Software Bill of Materials (SBOM) from projects built with esbuild or Bun.

🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

Git diff for SBOMs—compare CycloneDX, SPDX, and Syft documents, detect tampering, and gate CI.

Synapse - a governed control plane for software composition analysis, recon, evidence, and reporting. Verify Everything. Trust Nothing.