🔍 ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase, the Google Summer of Code, Azure credits, nexB and others generous sponsors!

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

BLint is a Binary Linter to check the security properties, and capabilities in your executables. Since v2, blint is also an SBOM generator for binaries.

CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments

A suite of utilities to help with software supply chain challenges on nix targets

ScanCode.io is a server to script and automate software composition analysis pipelines with ScanPipe pipelines. This project is sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase/ Google Summer of Code, nexB and others generous sponsors!

Python implementation of OWASP CycloneDX

A tool to generate a SBOM (Software Bill of Materials) for an installed Python module

Creates CycloneDX Software Bill of Materials (SBOM) documents for C/C++ projects using Conan

This tool compares two Software Bill of Materials (SBOMs) and reports the differences.

Automate open source license compliance and ensure software supply chain integrity

Generate VEX (Vulnerability Exploitability Exchange) CycloneDX documents

Modular framework for SBOM generation that gathers file information and analyzes dependencies

Library to ingest and generate SBOMs

Transform SBOM contents into a formatted document including markdown and PDF formats

A tool to reverse engineer and inspect the RPM and APT databases to list all the packages along with executables, service and versions.

Library to ingest and generate VEX documents

Generates SBOM files from system packaging information

Manage SBOM and VEX like source code

Create a dependency graph of the components within a SBOM