Sbom GitHub Repositories (2026) · Open Source Tools

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

IoT static scanner for secrets, SBOM, CVEs and more.

The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnerable components (openssl, libpng, libxml2, expat and others), or if you know the components used, you can get a list of known vulnerabilities associated with an SBOM or a list of components and versions.

Trusted builds made easy! A cloud-native software factory for building, testing, and releasing trusted software artifacts

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

Self-hosted artifact repository for many package formats: Maven, npm, PyPI, Docker/OCI, Helm, Debian, RPM, Go, Cargo, NuGet, RubyGems, Conda, Conan, Ivy, sbt and more.

scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.

sbomqs: The Comprehensive SBOM Quality & Compliance Tool

The Airgap Native Package Manager for Kubernetes

Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server

Catalogue all images of a Kubernetes cluster to multiple targets with Syft

Author, generate, validate and govern AI agent rules, skills, plugins and MCP configuration across 52 coding assistants. Review with verified model evidence, evaluate skills, lock and sign dependencies, and publish bundles. CLI, MCP server and Go API.

A suite of tools to automate software compliance checks.

GUAC aggregates software security metadata into a high fidelity graph database.

Scans your project to determine what components you use

Agentic SDLC infrastructure. Define guardrails. Collect signals. Enforce continuously. Signed records of what your AI coding agents and CI/CD pipelines did, checked against policies as code, with the loop closed in CI/CD. AI sessions, SBOMs, VEX, SARIF and SLSA provenance, built on Sigstore and in-toto. Apache 2.0.

A utility to generate SPDX-compliant Bill of Materials manifests

Semantic SBOM/CBOM/AI-BOM diff, quality scoring, and compliance validation for CycloneDX/SPDX — component, license, and vulnerability change analysis, cryptographic inventory grading, PQC readiness (CNSA 2.0, NIST IR 8547), and regulatory gates for NTIA, FDA, EU CRA, BSI TR-03183, EUCC, SSDF, EO 14028, and the EU AI Act.

A secure, high-performance, multi-tenant platform for remote App ”Hosting“ and ”Computing“

A license scanner for container images and filesystems.