Spdx GitHub Repositories (2026) · Open Source Tools

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

sbomqs: The Comprehensive SBOM Quality & Compliance Tool

Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server

Author, generate, validate and govern AI agent rules, skills, plugins and MCP configuration across 52 coding assistants. Review with verified model evidence, evaluate skills, lock and sign dependencies, and publish bundles. CLI, MCP server and Go API.

A suite of tools to automate software compliance checks.

GUAC aggregates software security metadata into a high fidelity graph database.

Ruby gem & CLI to detect a project's open source license (SPDX) from LICENSE files, package manifests, and READMEs

Agentic SDLC infrastructure. Define guardrails. Collect signals. Enforce continuously. Signed records of what your AI coding agents and CI/CD pipelines did, checked against policies as code, with the loop closed in CI/CD. AI sessions, SBOMs, VEX, SARIF and SLSA provenance, built on Sigstore and in-toto. Apache 2.0.

A utility to generate SPDX-compliant Bill of Materials manifests

Semantic SBOM/CBOM/AI-BOM diff, quality scoring, and compliance validation for CycloneDX/SPDX — component, license, and vulnerability change analysis, cryptographic inventory grading, PQC readiness (CNSA 2.0, NIST IR 8547), and regulatory gates for NTIA, FDA, EU CRA, BSI TR-03183, EUCC, SSDF, EO 14028, and the EU AI Act.

Functionality and DataModels of OWASP CycloneDX for Python

A CLI tool that prefetches project dependencies for hermetic container builds.

Creates CycloneDX Software Bill of Materials (SBOM) from Gradle projects