cyclonedx

Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server

Create CycloneDX Software Bill of Materials (SBOM) from Node.js NPM projects.

Create CycloneDX Software Bill of Materials (SBOM) from Node.js Yarn projects.

GitHub action to generate a CycloneDX SBOM for Node.js

GitHub action to generate a CycloneDX SBOM for Python

GitHub action to generate a CycloneDX SBOM for .NET

GitHub action to generate a CycloneDX SBOM for Go modules

AI provenance across your dependency tree. 14 ecosystems. CycloneDX and SPDX integration. Private registry.

„Local first AI knowledge assistant that shows how far each answer can be trusted: deterministic source check, signed receipts, any model / cloud, own server or on device.

🛡️ The fastest Trivy Action for GitHub. Scan Containers, Filesystems, and IaC for vulnerabilities. Supports SBOM, SARIF, and Daily DB Caching.

A SonarQube plugin that brings the CycloneDX Sunshine SBOM visualization directly into SonarQube, per project.

CycloneDX & SPDX SBOM generator, vulnerability scanner, EPSS exploit predictor, VEX engine, and compliance auditor for VS Code.

Manage npm dependencies directly in VS Code with version updates, vulnerability checks, license insights, and SBOM export.

SBOM diff gate: compares CycloneDX 1.4-1.6 / SPDX 2.3 SBOMs or git refs, reports added, removed, upgraded and downgraded components plus license, supplier and hash changes, checks OSV.dev for new vs fixed vulns, and enforces policy. Text/JSON/SARIF/Markdown, GitHub Action.

One supply-chain gate for npm projects: runs package-tripwire (risky dependency changes), license-sentinel (license policy), sbom-diff-sentinel (new vulnerabilities and SBOM drift) and workflow-sentinel (GitHub Actions hardening) with one config, one combined report (text, JSON, SARIF, Markdown) and one exit code.

License compliance gate for npm projects: reads node_modules and npm/pnpm/yarn lockfiles, resolves SPDX expressions and LICENSE texts, enforces allow/deny lists, presets and project-license compatibility, and emits CycloneDX 1.5 and SPDX 2.3 SBOMs, NOTICES, and text/JSON/SARIF/Markdown reports. Zero deps.

24 hours starts the moment you know. The EU Cyber Resilience Act Article 14 reporting clock as a GitHub Action: SBOM, actively exploited vulnerability detection (CISA KEV), ENISA drafts.

Lockfile-first SBOM and AI BOM generator and CVE exposure search. CLI, GitHub Action, and hosted API. CycloneDX 1.6 + SPDX 2.3.

node-dependency-track-upload

DSAbot generates a SBOM files in CyloneDX standard format