🔍 ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase, the Google Summer of Code, Azure credits, nexB and others generous sponsors!

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

Panthera(P.)uncia - Official CLI utility for Osprey Vision, Subdomain Center & Exploit Observer.

🎁 wraps all package managers with a unifying CLI

BLint is a Binary Linter to check the security properties, and capabilities in your executables. Since v2, blint is also an SBOM generator for binaries.

CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments

A suite of utilities to help with software supply chain challenges on nix targets

ScanCode.io is a server to script and automate software composition analysis pipelines with ScanPipe pipelines. This project is sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase/ Google Summer of Code, nexB and others generous sponsors!

Python implementation of OWASP CycloneDX

This tool compares two Software Bill of Materials (SBOMs) and reports the differences.

A tool to generate a SBOM (Software Bill of Materials) for an installed Python module

Automate open source license compliance and ensure software supply chain integrity

Modular framework for file information extraction and dependency analysis to generate accurate SBOMs

Creates CycloneDX Software Bill of Materials (SBOM) documents for C/C++ projects using Conan

Generate VEX (Vulnerability Exploitability Exchange) CycloneDX documents

Transform SBOM contents into a formatted document including markdown and PDF formats

Generates SBOM files from system packaging information

A tool to reverse engineer and inspect the RPM and APT databases to list all the packages along with executables, service and versions.

Library to ingest and generate VEX documents

Create CycloneDX Software Bill of Materials (SBOM) for Buildroot projects