Generate CycloneDX SBOM with open-source tools

We are in the process of developing SBOM generation tools. Contact us if you are interested in a feature preview.

You can use many different open-source tools to generate your SBOM in CycloneDX format. We support CycloneDX 1.4 and JSON and XML formats.

Note: We have not used all of these, so have appended an * to the ones we've used or have seen our clients use successfully.

Java *


Generate an SBOM for Java Core projects with the CycloneDX Java Core plugin.


Generate an SBOM for Java Maven projects with the CycloneDX Maven plugin.

Gradle *

Generate an SBOM for Java Gradle projects with th CycloneDX Gradle plugin or Gradle's own CycloneDX plugin.

JavaScript *

Generate an SBOM for JavaScript projects with the CycloneDX JavaScript library.




Generate an SBOM for Node.js Yarn projects with the CycloneDX Node module.


CocoaPods *

Generate SBOM for CocoaPods projects with the CycloneDX Cocoapod plugin.


NuGet *

Generate SBOM for .NET NuGet projects with the CycloneDX .NET module.

Python *

Generate SBOM for Python projects with the GitHub Python SBOM generation tool.


Generate SBOM for Python Pip projects with the CycloneDX Python SBOM generation tool.


Generate SBOM for Python Poetry projects with the CycloneDX Python SBOM generation tool.



Generate SBOM for PHP Composer projects with the CycloneDX PHP Composer plugin.



Generate SBOM for Golang projects with gomod using the CycloneDX-gomod tool.


Mix *

Generate SBOM for Elixir Mix projects using the CycloneDX SBOM generation Mix task



Generate SBOM for Erlang Rebar3 projects with the CycloneDX Rebar3 SBOM generation tool.


  • Microsoft's SBOM generation tool (microsoft.sbom.tool) apparently can detect NPM, NuGet, PyPI, CocoaPods, Maven, Golang, Rust Crates, RubyGems, Linux packages within containers, Gradle, Ivy, GitHub public repos, and more. It uses Component Detection to generate your SBOM.

  • Generate SBOM using Syft's CLI tool and Go library.

Linux kernel source code

  • Download Microsoft's SBOM tool the tool to your local environment, then give execute permission to the downloaded executable file:

    chmod +x ./sbom-tool

  • Download, then extract the Linux kernel source code from The Linux Kernel Archives. For example, this uses version 5.15.88:

    tar xvfJ linux-5.15.88.tar.xz

  • Run the SBOM generation tool:

    ./sbom-tool generate -b ./linux-5.15.88 -bc ./linux-5.15.88 -pn kernel -pv 5.15.88 -ps -nsb

  • Locate the generated SPDX file in ./linux-5.15.88/_manifest/spdx_2.2/ folder. It is named manifest.spdx.json. You will now need to convert the SPDX file to CycloneDX.

Ruby *

Generate SBOM for Ruby projects with the CycloneDX-ruby gem.

More tools

Last updated

© Copyright MedCrypt 2023, All rights reserved.