Sbom MCP Server

Extract SPDX and CycloneDX SBOMs from open-source projects, including the Linux kernel

What you get

A production-ready Python CLI for extracting Software Bill of Materials (SBOM) from open-source codebases. Built for scale — from small libraries to the Linux kernel (70k+ files).

• Multi-ecosystem dependency extraction — — parses manifests and lock files for Python, Node.js, Rust, Go, and Java (Maven + Gradle). Lock files are preferred over manifests for exact pinned versions
• Parallel file scanning — — thread pool for hashing and license extraction with a live progress bar
• Streaming JSON output — — SPDX 2.3, SPDX 3.0.1, and CycloneDX documents are written one entry at a time; the full document is never held in memory, making 70k+ file projects practical
• Catena-X / CX-0158 support — — generates CX-0158 compliant SPDX 3.0.1 JSON-LD (.spdx.jsonld) for automotive supply chain exchange, with all 4 propagation options
• Correct PURL generation — — all package references follow the Package URL spec (pkg:pypi/…, pkg:maven/…, etc.)
• CPE identifiers — — best-effort CPE 2.3 strings generated for every dependency, enabling vulnerability matching against the NVD

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.