cyclonedx

🔍 ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase, the Google Summer of Code, Azure credits, nexB and others generous sponsors!

licensing packages open-source-licensing dependency-graph provenance dependencies license spdx copyright sca spdx-licenses license-checking license-scan copyright-scan software-composition-analysis oss-compliance purl package-url sbom cyclonedx

Updated Oct 24, 2025
Python

ort

oss-review-toolkit / ort

Star 1.8k

A suite of tools to automate software compliance checks.

package-manager open-source-licensing dependency-graph compliance dependencies license spdx copyright hacktoberfest license-management sca dora cra ospo oss-compliance sbom cyclonedx sbom-generator

Updated Oct 24, 2025
Kotlin

guacsec / guac

Star 1.4k

GUAC aggregates software security metadata into a high fidelity graph database.

security graph supply-chain vulnerability vex spdx vulnerability-management software-supply-chain supply-chain-analytics sbom attestations in-toto cyclonedx slsa supply-chain-security supply-chain-visibility software-supply-chain-security spdx-sbom cyclonedx-sbom

Updated Oct 22, 2025
Go

owasp-dep-scan / dep-scan

Star 1.2k

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

security-audit containers dependency-analysis vex compliance cve sca vulnerability-scanners security-tools devsecops reachability-analysis sbom cyclonedx supply-chain-security risk-audit dependency-audit

Updated Oct 8, 2025
Python

XmirrorSecurity / OpenSCA-cli

Star 1.1k

OpenSCA is an open source software supply chain security solution that supports the detection of open source dependencies, vulnerabilities and license compliance with a widely noticed accuracy by the community.

security static-analysis vulnerabilities spdx software-supply-chain sca swid devsecops software-composition-analysis software-bill-of-materials license-compliance sbom cyclonedx software-supply-chain-security

Updated Oct 11, 2025
Go

package-url / purl-spec

Star 900

A minimal specification for purl aka. a package "mostly universal" URL, join the discussion at https://gitter.im/package-url/Lobby

url package dependencies spdx package-management purl package-url sbom cyclonedx

Updated Oct 23, 2025
Python

cdxgen

CycloneDX / cdxgen

Star 808

Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server

docker containers supply-chain owasp bom oci sca software-bill-of-materials purl package-url sbom cyclonedx saasbom cbom

Updated Oct 24, 2025
JavaScript

ARPSyndicate / puncia

Star 660

Panthera(P.)uncia - Official CLI utility for Osprey Vision, Subdomain Center & Exploit Observer.

exploit subdomain vulnerability sbom cyclonedx arpsyndicate sbom-tool cyclonedx-sbom

Updated Jun 29, 2025
Python

bomber

devops-kung-fu / bomber

Sponsor

Star 588

Scans Software Bill of Materials (SBOMs) for security vulnerabilities

golang security oss supply-chain spdx vulnerability-scanners security-automation security-tools devsecops supplychain syft sbom gomodule cyclonedx epss

Updated Mar 31, 2025
Go

meta-package-manager

kdeldycke / meta-package-manager

Sponsor

Star 535

🎁 wraps all package managers with a unifying CLI

windows macos linux homebrew ruby-gem npm package-manager steam yarn snap apt pip spdx flatpak php-composer mac-app-store package-url sbom cyclonedx xbar

Updated Oct 13, 2025
Python

chainloop-dev / chainloop

Star 505

Evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

security open-source-licensing compliance license spdx attestation devsecops ospo oss-compliance sbom in-toto cyclonedx slsa supply-chain-security sbom-distribution slsa-provenance metadata-platform sbom-discovery regulated-industry

Updated Oct 24, 2025
Go

specification

CycloneDX / specification

Star 435

OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. SBOM, SaaSBOM, HBOM, AI/ML-BOM, CBOM, OBOM, MBOM, VDR, and VEX

machine-learning supply-chain owasp specification standard bom software vex license spdx cpe swid bill-of-materials software-bill-of-materials sbom cyclonedx mbom saasbom tc54 cbom

Updated Oct 21, 2025
XSLT

cyclonedx-cli

CycloneDX / cyclonedx-cli

Star 420

CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions.

owasp bom vex spdx hacktoberfest bill-of-materials software-bill-of-materials purl package-url sbom cyclonedx sbom-generator obom mbom saasbom

Updated Oct 14, 2025
C#

owasp-dep-scan / blint

Star 413

BLint is a Binary Linter to check the security properties, and capabilities in your executables. Since v2, blint is also an SBOM generator for binaries.

binary malware fuzzing supply-chain-analytics sbom cyclonedx supply-chain-security depscan