sbom

LunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: https://github.com/marketplace/lunatrace-by-lunasec/

Analyze any snippet, file, or repository to detect possible security flaws such as secret in code, open source vulnerability, code security, vulnerability, insecure infrastructure as code, and potential legal issues with open source licenses.

The SCANOSS SBOM Workbench graphical user interface to scan and audit your source code.

Manage third-party license compliance in your Rollup or Vite builds. Automatically discover every dependency, extract its license info, fail builds with disallowed licenses, and generate a complete “bill-of-materials” in JSON, HTML, CSV or custom formats.

Generate CycloneDX Software Bill of Materials (SBOM) from webpack bundles at compile time.

AI coding agent for embedded IoT firmware in VS Code: Espressif ESP32 (ESP-IDF) and Nordic nRF52/53/54/91 (nRF Connect SDK, Zephyr). Builds, flashes and debugs on real hardware (RTT, UART, BLE sniffer), cellular LTE-M/NB-IoT/NB-NTN, Fanstel gateway firmware, and one-click EU Cyber Resilience Act readiness: SBOM (SPDX), CVE scan, secure-by-design.

Create SBOMs in CycloneDX format for your Vite, Rollup or Rolldown projects with ease

Functionality and DataModels of OWASP CycloneDX for JavaScript (Node.js or WebBrowser) written in TypeScript.

ChatCVE is an app using the Langchain SQL Language Tool to give a LLM prompt experience to CVE and SBOM DevSecOps Triage Data

AI-powered vulnerability triage platform for Python projects. KIRTA combines SBOM, SCA, static code analysis, call maps, and AI explanations to prioritize reachable security risks.

Gather SBOMs from the GitHub Dependency Graph and report matches with packages, such as malware advisories from the GitHub Advisory Database or PURLs of your choice

🛠️ Tool for generating SPDX 2.2/2.3 SBOMs from Azure DevOps repository artifacts using https://github.com/microsoft/sbom-tool

SBOMVert is an observability tool for SBOMs and CVE reports

100% Free & Open Source • Privacy-First Security Scanning and AI Code Review CLI

Open-source package registry for MCP (Model Context Protocol) servers with built-in security scanning, trust scoring (L1-L4), and CLI. Every bundle verified across 25 supply-chain controls.

Open-source post-quantum readiness tooling by quantakrypto

GitHub Action to perform a docker scan with VMWARE tern

Open-source server that refuses vulnerable package installs. The backend the refuse CLI shim calls.

GitHub Action that installs and sets up the Microsoft SBOM Tool.

Repository for the SBOM Harbor UI.