cyclonedx

🔍 ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet, the Google Summer of Code, Azure credits, nexB and other generous sponsors!

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

A minimal specification for purl aka. a package "mostly universal" URL, join the discussion at https://gitter.im/package-url/Lobby

Panthera(P.)uncia - Official CLI utility for Subdomain Center & Exploit Observer.

🎁 snapshot every package on your machine to one file, restore it on a new one

blint is a Binary Linter that checks the security properties and capabilities of your executables. It can also generate a Software Bill-of-Materials (SBOM) for supported binaries.

CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments

AI Bill of Materials — discover every AI agent, model, and API in your infrastructure

SBOM, provenance, dependency graph, and vulnerability tools for Nix.

Evidence-grounded cryptographic inventory and post-quantum migration planning for software repositories. Local static analysis, zero mandatory runtime dependencies, SARIF and CycloneDX output.

ScanCode.io is a server to script and automate software composition analysis with pipelines. This project is sponsored by the European Commission, NLnet NGI0, the Google Summer of Code, nexB and others generous sponsors!

See what your AI agents can access. Scan MCP configs for exposed secrets, shadow APIs, and AI models. Generate AI-BOMs for compliance.

Functionality and DataModels of OWASP CycloneDX for Python

A CLI tool that prefetches project dependencies for hermetic container builds.

Static security scanner for ML model files — detects pickle bombs, Keras Lambda RCE and GGUF template injection, and generates CycloneDX / SPDX AI-BOMs (AIBOM) as EU AI Act, CRA and FDA §524B evidence.

Automate open source license compliance and ensure software supply chain integrity

This tool compares two Software Bill of Materials (SBOMs) and reports the differences.

Transform SBOM contents into a formatted document including markdown and PDF formats

Modular framework for file information extraction and dependency analysis to generate accurate SBOMs

Generates SBOM files from system packaging information