SBOM tools: open-source generators, analysers and how to choose

SBOM tooling falls into a few distinct jobs: generating, validating, converting, scoring and analysing. This guide maps well-known open-source tools to those jobs and sets out criteria for choosing among them.

The jobs SBOM tools do

"SBOM tool" covers several different functions. Separating them makes selection easier:

Generators

• Syft is a CLI and Go library that generates SBOMs from container images, filesystems and archives across many packaging ecosystems, with CycloneDX, SPDX and its own JSON output. It is Apache-2.0 licensed ^[1].
• cdxgen, a CycloneDX project, generates CycloneDX BOMs for many languages and package managers and for container images, offers SPDX 3.0.1 JSON-LD export, and can produce CBOM, OBOM, SaaSBOM and other BOM types. It can also run as a server ^[2].
• Trivy is a security scanner that can generate SBOMs in CycloneDX and SPDX formats ^[3].
• Microsoft SBOM Tool creates SPDX 2.2 and SPDX 3.0 SBOMs for build artefacts on Windows, Linux and macOS, and includes a validate command; it is MIT licensed ^[4].

Validators and converters

• CycloneDX CLI validates, converts, diffs, merges, signs and verifies BOMs. It converts between CycloneDX XML, JSON and Protobuf and SPDX JSON 2.3, and warns that SPDX–CycloneDX conversion can lose information ^[5].
• SPDX tools-python parses, validates and converts SPDX 2.2 and 2.3 documents across tag-value, RDF, JSON, YAML and XML, with experimental SPDX 3.0 write support ^[6].
• NTIA Conformance Checker checks whether an SPDX SBOM contains the NTIA minimum elements, and optionally CISA's 2024 Framing Software Component Transparency baseline ^[7].
• protobom, an OpenSSF sandbox project, provides a format-neutral representation for reading and writing SPDX and CycloneDX ^[8].

Quality scoring

sbomqs scores SPDX and CycloneDX SBOMs on a 0–10 scale across categories such as identification, provenance, integrity, completeness and licensing, and runs compliance checks against NTIA, BSI TR-03183-2 and other profiles ^[9]. sbom-scorecard also scores SBOMs, but its repository describes it as work in progress with no stable release ^[10]. More on this in SBOM validation.

Analysis

• Grype scans container images, directories and SBOMs for known vulnerabilities and supports OpenVEX for filtering results ^[11].
• Trivy accepts CycloneDX and SPDX SBOMs as a scan target for vulnerabilities and licences ^[12].
• OSV-Scanner checks dependencies against the OSV.dev database and supports offline scanning against a local copy ^[13].
• OWASP Dependency-Track is a continuous component-analysis platform that consumes CycloneDX SBOMs and VEX, draws on several vulnerability sources and has a policy engine and API ^[14].
• GUAC, an OpenSSF project, aggregates SBOMs, SLSA attestations, OSV data, Scorecard results and VEX into a graph for querying ^[15].

How to choose

1. Ecosystem coverage. Test each generator on your real repositories and images. Missing lockfile support is the most common source of incomplete SBOMs.
2. Lifecycle stage. Decide whether you need source, build, analysed or runtime SBOMs; see SBOM generation.
3. Output fields. Check hashes, licences, purls and dependency relationships against the fields you must supply, such as the CERT-In 21 fields.
4. Formats and versions. Confirm the CycloneDX and SPDX versions your consumers accept.
5. Offline operation. Air-gapped environments need tools that run without network calls and vulnerability data that can be mirrored.
6. Pipeline fit. Prefer tools that return non-zero exit codes on failure so a pipeline can stop a release.
7. Project health. Check release cadence, maintainers and licence before standardising.

Tools produce and check documents. Governing them across hundreds of applications and suppliers is a platform question; see SBOM platforms.

How IntelliXBOM helps

IntelliXBOM generates SBOMs and ingests CycloneDX and SPDX documents from any of these tools, validates them against required-field policies, and keeps version history. It then correlates components with vulnerabilities, known-exploited lists, licences and end-of-life data, and links them to business services.