cdxgen

{
  "aliases": [],
  "alternatives": [],
  "build_dependencies": [],
  "categories": [],
  "caveats": null,
  "conflicts_with": [],
  "dependencies": [
    "dotnet",
    "node",
    "ruby",
    "sourcekitten",
    "trivy"
  ],
  "deprecated": 0,
  "deprecation_reason": null,
  "desc": "Creates CycloneDX Software Bill-of-Materials (SBOM) for projects",
  "disable_reason": null,
  "disabled": 0,
  "enrichment_fetched_at": "2026-06-20T23:36:15+00:00",
  "first_seen": "2026-06-20T23:34:18+00:00",
  "full_name": "cdxgen",
  "github_default_branch": "master",
  "github_last_commit_at": "2026-06-20T19:16:09Z",
  "github_readme_excerpt": "[![SBOM](https://img.shields.io/badge/SBOM-with_%E2%9D%A4%EF%B8%8F_by_cdxgen-FF753D)](https://github.com/cdxgen/cdxgen)\n[![AI-DECLARATION: pair](https://img.shields.io/badge/\u4dfc%20AI--DECLARATION-pair-ffedd5?labelColor=ffedd5)](./AI-DECLARATION.md)\n[![JSR][badge-jsr]][jsr-cdxgen]\n[![NPM][badge-npm]][npmjs-cdxgen]\n[![GitHub Releases][badge-github-releases]][github-releases]\n[![NPM Downloads][badge-npm-downloads]][npmjs-cdxgen]\n[![GitHub License][badge-github-license]][github-license]\n[![GitHub Contributors][badge-github-contributors]][github-contributors]\n[![SWH][badge-swh]][swh-cdxgen]\n\n# CycloneDX Generator (cdxgen)\n\n\u003cimg src=\"./docs/_media/cdxgen.png\" width=\"200\" height=\"auto\" /\u003e\n\ncdxgen is a CLI tool, library, [REPL](./ADVANCED.md), and server to create, validate, sign, and verify software BOMs. It generates CycloneDX JSON BOMs and supports SPDX 3.0.1 JSON-LD export. CycloneDX is a full-stack BOM specification that is easily created, human and machine-readable, and simple to parse. The tool supports CycloneDX specification versions from 1.5 - 1.7.\n\nSupported BOM formats:\n\n- Hardware (HBOM) - For supported live hosts such as Apple Silicon macOS and Linux amd64/arm64 systems.\n- Software (SBOM) - For many languages and container images.\n- Cryptography (CBOM) - For Java keystores and certificates, plus JavaScript and TypeScript source-level algorithm inventory.\n- Operations (OBOM) - For Linux container images and VMs running Linux or Windows operating systems.\n- Software-as-a-Service (SaaSBOM) - For Java, Python, JavaScript, TypeScript, and PHP projects.\n- AI/ML (AI-BOM) - For prompt files, AI services, MCP configs, and model metadata with explainable AI-governance, security, performance, and agentic findings.\n- Attestations (CDXA) - Generate SBOM with templates for multiple standards. Sign the BOM document at a granular level to improve authenticity.\n- Vulnerability Disclosure Report (VDR) - Use cdxgen with [OWASP depscan](https://github.com/owasp-dep-scan/dep-scan) t",
  "github_repo": "CycloneDX/cdxgen",
  "github_stars": 997,
  "github_topics": [
    "bom",
    "cbom",
    "containers",
    "cyclonedx",
    "docker",
    "oci",
    "owasp",
    "package-url",
    "purl",
    "saasbom",
    "sbom",
    "sca",
    "software-bill-of-materials",
    "spdx",
    "spdx-sbom",
    "supply-chain"
  ],
  "homepage": "https://github.com/CycloneDX/cdxgen",
  "homepage_og_description": null,
  "homepage_og_image": null,
  "homepage_title": null,
  "installs_30d": 1083,
  "installs_365d": 7766,
  "installs_90d": 2895,
  "keg_only": 0,
  "keg_only_reason": null,
  "last_seen": "2026-06-20T23:34:18+00:00",
  "license": "Apache-2.0",
  "llm_generated_at": null,
  "llm_model": null,
  "name": "cdxgen",
  "oldnames": [],
  "one_liner": null,
  "optional_dependencies": [],
  "rank_30d": 1263,
  "rank_365d": 1594,
  "rank_90d": 1377,
  "raw_hash": "1db86f39a2c59afb",
  "recommended_dependencies": [],
  "revision": 0,
  "ruby_source_path": "Formula/c/cdxgen.rb",
  "tap": "homebrew/core",
  "test_dependencies": [],
  "uses_from_macos": [],
  "version_head": null,
  "version_stable": "12.6.0",
  "versioned_formulae": [],
  "why_use_this": null
}