SBOM Analyzer

An SBOM is a formal, machine-readable inventory of every software component in an application — direct dependencies, transitive dependencies, their versions, suppliers, and license information. Think of it as the ingredient list on a food package, but for software. SBOMs are increasingly required by government agencies (US Executive Order 14028), financial institutions, and enterprise procurement. They enable rapid vulnerability response: when a new CVE drops, teams with SBOMs can immediately query which of their products are affected instead of manually auditing thousands of dependencies.

Both are open SBOM standards, but with different origins and strengths. SPDX (Software Package Data Exchange) was created by the Linux Foundation in 2010 and is an ISO/IEC standard (5962:2021). It was originally designed for license compliance and is the older, more widely implemented format. CycloneDX was created by OWASP in 2017 with a security-first focus — it supports vulnerability data, service dependencies, hardware BOMs, and ML model BOMs in addition to software packages. CycloneDX JSON is typically more compact and developer-friendly; SPDX has more tooling support in legal/compliance workflows. Both are acceptable under US government SBOM guidance. This tool auto-detects which format you paste.

Components with no license information (NOASSERTION or missing) are the highest risk — you cannot distribute software that includes unlicensed code without legal exposure. Copyleft licenses (GPL-2.0, GPL-3.0, AGPL-3.0) require that derivative works also be open-sourced under the same terms, which can conflict with proprietary software distribution. License incompatibilities between components can also block distribution. This tool highlights unlicensed components in red and shows a license distribution table so you can quickly spot unexpected copyleft or missing license entries.

For Node.js: use 'npx @cyclonedx/cyclonedx-npm --output-format JSON > sbom.json'. For Python: use 'pip install cyclonedx-bom && cyclonedx-py -o sbom.json'. For Java/Maven: use the CycloneDX Maven plugin. For Go: use 'go install github.com/CycloneDX/cyclonedx-gomod && cyclonedx-gomod app -json -output sbom.json'. For Docker images: use 'syft image:tag -o cyclonedx-json > sbom.json' (Syft by Anchore works across languages). GitHub's Dependency Graph also exports SPDX SBOMs from the repository Security tab. Paste the output JSON into this tool to analyze it.