cyclonedx

Synthetic, reproducible fixtures for the CycloneDX 2.0 environmentVars migration boundary

Synapse - a governed control plane for software composition analysis, recon, evidence, and reporting. Verify Everything. Trust Nothing.

Type-safe CycloneDX SBOM parser for PHP

A minimal specification for purl aka. a package "mostly universal" URL, join the discussion at https://gitter.im/package-url/Lobby

Diffs two SBOMs (CycloneDX/SPDX) and highlights added, removed, and version-changed components. Useful as a supply-chain change review step in CI.

Identity Security Graph — unify humans, service accounts, keys and AI agents in one graph; detect excessive privilege and anomalous behavior (Apache-2.0)

Monitor your local AI agents. See what files they can reach, what networks they communicate with, and stop them if required. Detect a rogue agent.

AIBOM generator for AI agent harnesses (Hermes, OpenClaw) - CycloneDX 1.6 output for runtime, model, skill, MCP, hook, and secrets-surface components

A suite of tools to automate software compliance checks.

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

A scalable server implementation of the OSS Review Toolkit.

CLI for EU Cyber Resilience Act compliance evidence: SBOM validation, vulnerability checks, and signing

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

sbomqs: The Comprehensive SBOM Quality & Compliance Tool

sbomasm: The Complete SBOM Management Toolkit

Agent skill for Claude Code and OpenAI Codex that triages one CVE/GHSA/OSV id against a Python repo using RBVM: CVSS, EPSS, KEV, reachability and exposure → SSVC Deployer decision → CycloneDX/OpenVEX record Dependency-Track can ingest.

A vulnerability scanner for container images and filesystems

Parse SPDX, CycloneDX, generate-license-file, and Black Duck notices output into one normalized model, with React components to search, group, and diff third-party license disclosures.

A capability-typed language that emits machine-verifiable supply-chain SBOMs by construction: per-function CycloneDX, SPDX, VEX and SLSA artefacts that match the code, not a scanner's guess.

OCIDex ingests CycloneDX SBOMs, links them to the software artifacts they describe, and gives you a searchable inventory of every component, version, and license across your entire portfolio — with a changelog that shows exactly what changed between releases.