SBOMix scans your repository and produces CycloneDX, SPDX, and AI-BOM outputs in seconds — plus vulnerability enrichment and a hosted dashboard.
Compliance audits arrive without warning, CI fails silently on known CVEs, and no one has a clear picture of what's actually running in production — let alone which AI models it depends on.
A customer or auditor asks for an SBOM and you have no automated way to produce one. Manually inventorying dependencies takes days and is immediately out of date.
A critical CVE blocks a release. You have no automated gate that would have caught it before it reached your security review. The fix was always to shift left — now you have the tool.
Each repo gets scanned in isolation if it gets scanned at all. There's no org-wide dashboard showing what's used where, which AI models are deployed, or which team owns what risk.
SBOMix auto-detects your lock files and package manifests. No config. No flags. Just point it at a repo.
Industry-standard SBOM format with vulnerability enrichment and AI/ML-BOM profile support.
Linux Foundation standard. Includes license detection and component provenance.
CycloneDX, SPDX, and AI-BOM all in one scan. No separate tools. No format conversion headaches.
Every component is checked against the latest CVE databases. Critical issues are flagged immediately.
Drop the action into your workflow. It scans on every PR, blocks on critical CVEs, and posts results to your dashboard.
Automatically detects PyTorch, TensorFlow, Hugging Face models, and other AI frameworks in your codebase.
Org-wide visibility. Track SBOM history, vulnerability trends, compliance coverage, and AI-BOM inventory over time.
Integrate SBOMix into your existing tools. Webhooks notify your security team when new CVEs appear.
For teams running agents with signing authority: one flag adds an MCP tool-surface and signing-library inventory, mapped to EU AI Act and OWASP Agentic AI references. Presence detection, not an audit.
The AI-BOM extends the SBOM to cover model provenance, data lineage, agentic scope, and governance — the parts of your supply chain that traditional SBOMs miss entirely.
Which model, which version, where it came from, and the hash of the weights file.
The dataset a model was trained on, its license, and governance metadata.
Inference endpoints, API keys, and external service dependencies.
Capability flags derived from MCP config — shell access, filesystem breadth, network reach, unpinned tool versions.
ISO/IEC 42001 and EU AI Act Article 11 + Annex IV controls assessed automatically. Compliance coverage percentage reported per scan.
Syft and Trivy run via Docker in this benchmark, adding a few seconds of startup overhead. Native installs narrow the gap, but reading a resolved lock file directly is still an order of magnitude faster than walking the filesystem. Reproduce with npm run bench.
| Repository | SBOMix | Syft | Trivy |
|---|---|---|---|
| nestjs/nest (npm, 2,366 components) | 463ms | 27.7s | 86.6s |
| BurntSushi/ripgrep (Rust, 82 components) | 268ms | 11.8s | 15.4s |
Give SBOMix a GitHub repo, a local path, or drop it into a GitHub Action. No configuration required.
SBOMix auto-detects your dependencies across all ecosystems, detects AI models, and checks for known vulnerabilities.
Get three files (CycloneDX, SPDX, AI-BOM) or push to the hosted dashboard for org-wide tracking and alerts.
The CLI is MIT licensed and always free. The hosted platform is optional and starts at $49/month.
A Software Bill of Materials (SBOM) is a list of all the components, libraries, and dependencies in a piece of software. It's like an ingredient list for code. SBOMix generates SBOMs in CycloneDX and SPDX formats, the two industry standards.
An AI Bill of Materials extends the SBOM to cover AI-specific risks: model provenance, data lineage, agentic scope, and governance. It answers questions like "which model is my app calling," "where did the weights come from," and "what is this MCP server allowed to do."
No. The CLI clones the repo temporarily, reads lock files and manifests, then deletes the clone. Only the SBOM metadata (component names, versions, hashes, vulnerability IDs) is sent to the hosted platform — never source files, secrets, or environment variables.
SBOMix falls back to manifest files (package.json, pom.xml, pyproject.toml, etc.) and performs best-effort resolution. For Maven projects without a local Maven install, it returns direct dependencies only and logs a warning. Full transitive resolution requires mvn on the path.
Add the action to any workflow. It scans the repo, writes SBOM artifacts, posts a summary comment on the PR, and optionally blocks the merge if critical CVEs are found. Set SBOMIX_API_KEY in your repository secrets to push results to the hosted dashboard automatically.
It stores a history of every SBOM for every app in your org. You get a dashboard with vulnerability trends over time, quality score tracking, AI-BOM coverage, and email alerts when new critical CVEs appear in components you already have deployed.
Yes — it's live at api.sbomix.com. Register for free and start pushing SBOMs within minutes. The 14-day trial includes all Hosted tier features with no credit card required.
A report for teams running AI agents with signing authority — the question it answers is "what's in the agent holding our keys." Run npx sbomix . --profile crypto-agent and it adds an MCP tool-surface inventory (which servers, what authority, pinned or not), a signing-library scan (wallet SDKs across EVM, Solana, Bitcoin, and more), and a known-bad/typosquat check to your scan, mapped to EU AI Act and OWASP Agentic AI Top 10 references. It's also available from the hosted dashboard and as a GitHub Action input. This is presence detection and static inventory, not a code audit, a security rating, or a certification.
Register in 30 seconds. No credit card. Push your first SBOM in under 5 minutes.
Create your free account →Or run npx sbomix owner/repo right now