Sbom MCP Server

Extract SPDX and CycloneDX SBOMs from open-source projects, including the Linux kernel

Local serverstdioPython

What is the Sbom MCP server?

Sbom MCP server exists for a simple reason — assistants are far more useful when they can act on Sbom directly instead of describing what you should do. Extract SPDX and CycloneDX SBOMs from open-source projects, including the Linux kernel.

What you get

A production-ready Python CLI for extracting Software Bill of Materials (SBOM) from open-source codebases. Built for scale — from small libraries to the Linux kernel (70k+ files).

  • Multi-ecosystem dependency extraction — — parses manifests and lock files for Python, Node.js, Rust, Go, and Java (Maven + Gradle). Lock files are preferred over manifests for exact pinned versions
  • Parallel file scanning — — thread pool for hashing and license extraction with a live progress bar
  • Streaming JSON output — — SPDX 2.3, SPDX 3.0.1, and CycloneDX documents are written one entry at a time; the full document is never held in memory, making 70k+ file projects practical
  • Catena-X / CX-0158 support — — generates CX-0158 compliant SPDX 3.0.1 JSON-LD (.spdx.jsonld) for automotive supply chain exchange, with all 4 propagation options
  • Correct PURL generation — — all package references follow the Package URL spec (pkg:pypi/…, pkg:maven/…, etc.)
  • CPE identifiers — — best-effort CPE 2.3 strings generated for every dependency, enabling vulnerability matching against the NVD

Setting it up

Installation goes through your MCP client rather than a global install: point it at sbom-generator on PyPI and it is fetched when the client starts. The copy-paste blocks for Claude Desktop, Claude Code and Cursor are further down this page.

Choosing this one

Among the planning and project tracking options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes.

SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.

Before you rely on it

  • It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
  • MCP clients confirm each tool call by default. Leave that on until you have watched what the sbom mcp server does with a few real requests.

How to install the Sbom MCP server

{
  "mcpServers": {
    "sbom-generator": {
      "command": "uvx",
      "args": ["sbom-generator"]
    }
  }
}

Add to claude_desktop_config.json, then restart Claude Desktop.

Frequently asked questions

It connects Sbom to MCP-compatible AI assistants such as Claude and Cursor. Instead of copying data back and forth by hand, the assistant works with Sbom directly.