#sbom

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Functionality and DataModels of OWASP CycloneDX for Python

The Airgap Native Package Manager for Kubernetes

CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments

GUAC aggregates software security metadata into a high fidelity graph database.

Scans your project to determine what components you use

A suite of tools to automate software compliance checks.

AI red-teaming tool and LLM security framework to evaluate agentic AI applications. Tests prompt injections, handles vulnerability assessment, SBOM generation, and static analysis.

scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.

Open security scanner and self-hosted control plane for AI, MCP, and cloud. One evidence model — run scans in your environment, centralize findings, govern in your VPC.

Open security scanner and self-hosted control plane for AI, MCP, and cloud. One evidence model — run scans in your environment, centralize findings, govern in your VPC.

Macaron is an extensible supply-chain security analysis framework from Oracle Labs that supports a wide range of build systems and CI/CD services. It can be used to prevent supply chain attacks, detect malicious Python packages, or check conformance to frameworks, such as SLSA. Documentation:

sbomify is a product security artifact hub and a trust center.