Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server

OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. SBOM, SaaSBOM, HBOM, AI/ML-BOM, CBOM, OBOM, MBOM, VDR, and VEX

Semantic SBOM/CBOM/AI-BOM diff, quality scoring, and compliance validation for CycloneDX/SPDX — component, license, and vulnerability change analysis, cryptographic inventory grading, PQC readiness (CNSA 2.0, NIST IR 8547), and regulatory gates for NTIA, FDA, EU CRA, BSI TR-03183, EUCC, SSDF, EO 14028, and the EU AI Act.

A toolset for dealing with Cryptography Bill of Materials (CBOM)

Functionality and DataModels of OWASP CycloneDX for Python

This repository contains a SonarQube Plugin that detects cryptographic assets in source code and generates CBOM.

FIPS 203 ML-KEM (CRYSTALS-Kyber) for Rust. Pure-Rust, no_std, ACVP 180/180, KyberSlash-clean, SLSA L3 + cosign-signed releases. Published on crates.io as kyberlib and kyberlib-wasm.

A tool for detecting cryptographic assets in container images and directories, and generating CBOMs.

Data and schema powering the worlds largest collection of SBOM/xBOM products, projects, and services

GitHub Action to generate Cryptography Bill of Materials (CBOM)

Cryptographic Discovery Scanner - Find every cryptographic algorithm in your codebase and now your quantum risk - part of the QRAMM Toolkit by CSNP

BF-CBOM: Your Best Friend for Generating, Understanding, and Comparing Cryptography Bills of Material (CBOMs)

Open-source post-quantum readiness tooling by quantakrypto

Présentation sur la sécurisation de la chaîne d'approvisionnement logicielle via les Software Bill Of Materials

Cryptographic asset discovery and PQC readiness scanner with CycloneDX CBOM output

TLS/SSL security analyzer for quantum readiness assessment and CNSA 2.0 compliance

Cryptographic Dependency Scanner - Identify quantum-vulnerable cryptographic algorithms in your software dependencies. Part of the QRAMM Toolkit.

CLI tool to scan filesystems, containers, and network ports for cryptographic assets and generate a CycloneDX CBOM.

Post-quantum cryptography scanner: detects quantum-vulnerable algorithms across 14+ languages with CycloneDX 1.7 CBOM output and CNSA 2.0 compliance checking