cbom

Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server

CBOM scanner to inventory cryptographic assets and assess quantum resilience

Cryptographic inventory and post quantum readiness. Scans code, certificates and live endpoints, writes a CycloneDX 1.6 CBOM, and scores exposure with Mosca inequality. Zero dependencies.

Open-source post-quantum cryptography scanner core. Detects RSA/ECC vulnerable to quantum attacks. MIT licensed, reproducible builds. quantumscan.io

Free GitHub Action & CLI that finds quantum-vulnerable cryptography (RSA, ECC, DH) in your code and dependencies, and produces a CycloneDX CBOM + quantum-readiness report.

Open-source local scanner that discovers quantum-vulnerable crypto, builds an evidence-backed CBOM, and prioritizes post-quantum migration.

FIBEMATE toolset: static-analysis detector, git-history time-machine, erasure-evidence prover (Apache-2.0, no crypto algorithms)

Find quantum-vulnerable cryptography in a JavaScript dependency tree. Reads the lock file, separates what Shor breaks from what Grover weakens, and emits a CycloneDX 1.6 CBOM.

Contains a tool (and test files) for creating a JSON Cryptographic-Bill-Of-Materials (CBOM) document. The tool is a prototype and is still under development. Currently able to create CBOM documents only from Javascript files that use the Node Crypto module.

Cryptography Bill of Materials scanner — inventory a codebase's crypto, classify post-quantum risk, map to NIST PQC, emit CycloneDX 1.6. Zero deps, nothing uploaded.