Top Tools for Automating SBOMs

What are SBOM tools?

SBOM tools are software utilities designed to automatically create and manage Software Bill of Materials (SBOMs). An SBOM is a detailed inventory of all components—such as libraries, modules, and dependencies—used within a software application. These tools collect metadata from source code, binaries, containers, or package manifests and output structured documents describing each component’s identity, version, source, and associated licenses.

The core function of SBOM tools is to increase visibility into the software supply chain. They help organizations understand what’s inside their software, where components come from, and how they interact. This is especially important in complex applications that rely heavily on third-party and open-source packages.

SBOM tools support standard formats like SPDX, CycloneDX, and SWID, which makes their outputs interoperable across different tools and platforms. Many also provide features such as continuous integration (CI) pipeline hooks, license tracking, vulnerability scanning, and audit logs, enabling teams to maintain up-to-date, compliant, and secure software inventories throughout the development lifecycle.

Why are SBOM tools important?

SBOM tools play a critical role in strengthening software security and regulatory compliance. By offering detailed insight into the components of software systems, these tools allow organizations to quickly identify and fix vulnerabilities, reducing the risk of breaches caused by outdated or insecure dependencies. This visibility ensures that all components are continuously monitored and maintained at secure, up-to-date versions.

Beyond security, SBOM tools are increasingly vital for meeting compliance requirements. Regulatory bodies and government agencies across the globe now emphasize or mandate the use of SBOMs, reflecting a growing global consensus that SBOMs are foundational for managing software supply chain risk:

• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recommends them as part of secure development practices
• U.S. Executive Order 14028 mandates that the National Institute of Standards and Technology (NIST) develop related guidelines for federal software procurement. 
• The National Telecommunications and Information Administration (NTIA) has defined the minimum elements of an SBOM
• In the UK, equivalent initiatives exist through ENISA and the NCSC. 

How do SBOM tools work?

SBOM tools operate by scanning software artifacts—such as source code, binaries, or containers—to identify and catalog all components and their relationships. They typically support multiple input types, including language-specific package manifests (e.g., package.json, pom.xml) and compiled binaries, allowing them to function across different development environments and deployment formats.

The tools parse these inputs to extract metadata about each component, including name, version, origin, and licensing information. This data is then structured into a standardized SBOM format such as SPDX, CycloneDX, or SWID, making it interoperable across tools and systems.

Many SBOM tools also integrate with continuous integration and deployment (CI/CD) pipelines. This enables automatic SBOM generation during build processes, ensuring that the software inventory remains accurate and up to date. Some tools enhance this functionality with vulnerability databases and license compliance checks, flagging issues as part of the build or release process.

Types of SBOM tools

SBOM tools can be grouped into several categories based on their primary use cases, integration points, and the environments they target:

1. Generic SBOM tools: These tools work across multiple languages, frameworks, and artifact types. They can generate SBOMs from source code, binaries, or containers without requiring language-specific integrations. They are often used as general-purpose solutions and support standard SBOM formats such as SPDX and CycloneDX.

2. Software Composition Analysis (SCA) tools with SBOM generation: Many SCA platforms now include the ability to create SBOMs alongside their primary function of detecting vulnerabilities and license risks in dependencies. These tools often integrate deeply with CI/CD pipelines and offer security scanning in addition to SBOM generation.

3. Container-focused SBOM tools: Designed for containerized environments, these tools detect both build-time and runtime dependencies inside container images. They may embed SBOMs directly into image layers or integrate with container registries to make inventories accessible after deployment.

4. CI/CD-integrated SBOM tools: These tools are optimized for automation within build pipelines. They generate SBOMs during the build process, ensuring that each software release includes a complete and current inventory. They are often implemented as plugins, GitHub Actions, or standalone CLI utilities for pipeline integration.

5. Language- or ecosystem-specific SBOM tools: Some SBOM tools are tailored for specific programming languages or ecosystems, such as C/C++. They integrate with native build systems (e.g., CMake) to capture dependencies accurately and output SBOMs in standard formats.

6. SBOM utilities: These are supporting tools that perform SBOM-related tasks such as converting between formats, validating SBOM structure, or generating SBOMs from installed system packages. They enhance interoperability and ensure compliance with specification requirements.

Generic SBOM tools

1. Microsoft sbom-tool

Description: The Microsoft SBOM Tool is a scalable, enterprise-ready tool to create SPDX 2.2 compatible SBOMs for various artifacts. It uses Component Detection libraries to identify components and the ClearlyDefined API to populate license information.

Key features:

• Generates SPDX 2.2 compatible SBOMs.
• Uses Component Detection libraries to identify components.
• Populates license information via the ClearlyDefined API.
• Supports various artifact types.
• Designed for scalability and enterprise environments.

GitHub: microsoft/sbom-tool

2. Syft

Description: Syft is a CLI tool and Go library for generating SBOMs from container images and filesystems. It provides detailed visibility into packages and dependencies, supporting multiple SBOM formats and integrating with vulnerability scanners.

Key features:

• Generates SBOMs from container images and filesystems.
• Supports multiple SBOM formats.
• Provides detailed visibility into packages and dependencies.
• Integrates with vulnerability scanners like Grype.
• Can be integrated into CI/CD pipelines.

GitHub: anchore/syft

3. SPDX SBOM Generator

Description: The SPDX SBOM Generator is a command-line tool that facilitates the generation of SBOMs adhering to the SPDX v2.2 specification. It supports multiple programming languages and package managers, enabling integration into CI/CD pipelines.

Key features:

• Generates SBOMs in SPDX v2.2 format.
• Supports multiple languages and package managers.
• Includes components, licenses, copyrights, and security references.
• Aligns with NTIA's minimum elements for SBOMs.
• Command-line interface for easy integration.

GitHub: opensbom-generator/spdx-sbom-generator

SCA tools that can generate SBOMs

4. Mend.io

Description: Mend SCA provides comprehensive software composition analysis with the ability to automatically generate and export accurate SBOMs. It identifies all open-source components and dependencies across applications, detects vulnerabilities and license risks, and produces standardized SBOMs in multiple formats for compliance, audit, and supply chain security needs. Mend SCA ensures organizations not only know what’s in their software, but also have a trusted, actionable inventory that integrates seamlessly into development and governance workflows.

5. Veracode SCA Agent

Description: The Veracode Software Composition Analysis (SCA) Agent is a command-line tool that can generate and scan SBOMs to identify open-source components, vulnerabilities, and licensing issues. It supports multiple SBOM formats and can be integrated into build pipelines to automate software supply chain security checks. The agent can produce SBOMs from existing project files or import SBOMs in SPDX and CycloneDX formats for analysis.

Key features:

• Generates and scans SBOMs for vulnerabilities and license issues.
• Supports SPDX and CycloneDX SBOM formats.
• Works with multiple languages and package managers.
• Can import and analyze existing SBOMs.
• Integrates into CI/CD pipelines for automated checks.

Repository: https://docs.veracode.com/r/Scanning_a_Software_Bill_of_Materials_SBOM_with_agent 

SBOM tools for containers

6. Paketo Buildpacks

Description: Paketo Buildpacks are modular build tools that convert application source code into container images. They automatically detect and include application dependencies and can generate SBOMs for both build-time and runtime environments. Paketo supports SBOM generation in SPDX and CycloneDX formats and embeds the SBOMs in container image layers, making them accessible for later inspection.

Key features:

• Generates SBOMs for build-time and runtime dependencies.
• Supports SPDX and CycloneDX formats.
• Embeds SBOMs directly into container image layers.
• Works across multiple languages and frameworks.
• Automatically detects and packages dependencies.

GitHub: https://github.com/buildpacks/pack 

7. Trivy

Description: Trivy is an open-source security scanner for containers, filesystems, and code repositories. It can generate SBOMs in SPDX and CycloneDX formats while scanning for vulnerabilities, misconfigurations, and license issues. Trivy supports scanning container images, local directories, and Git repositories, and integrates with CI/CD pipelines for automated security checks.

Key features:

• Generates SBOMs in SPDX and CycloneDX formats.
• Scans for vulnerabilities, misconfigurations, and license issues.
• Supports container images, filesystems, and repositories.
• Integrates into CI/CD pipelines.
• Maintains up-to-date vulnerability databases.

GitHub: https://github.com/aquasecurity/trivy 

SBOM tools for CI/CD

8. CycloneDX generator

Description: cdxgen is a command-line tool, library, REPL, and server designed to generate CycloneDX-compliant SBOMs. It aggregates all project dependencies into a JSON-formatted BOM, supporting various programming languages and package managers. 

Key features:

• Supports multiple languages and package managers.
• Generates SBOMs in JSON format.
• Provides a REPL and server mode for integration.
• Supports CycloneDX specification versions 1.4 to 1.6.
• Can be integrated into CI/CD pipelines.

GitHub: CycloneDX/cdxgen

9. GitHub action for SBOM generation

Description: The Anchore SBOM Action is a GitHub Action for generating SBOMs directly within workflows. It supports multiple input sources, including container images and local files, and outputs in CycloneDX and SPDX formats. The action enables automated SBOM generation as part of the CI process, ensuring that each build produces a complete and accurate BOM.

Key features:

• Generates SBOMs in CycloneDX and SPDX formats.
• Works with container images and local file sources.
• Runs natively within GitHub Actions workflows.
• Automates SBOM creation in CI pipelines.
• Supports integration with vulnerability scanning tools.

GitHub: https://github.com/anchore/sbom-action 

SBOM tools for C/C++

10. CMake SBOM Module

Description: The CMake SBOM module is an extension for the CMake build system that automatically generates SPDX-compliant SBOMs during the build process. It collects information about all dependencies, including libraries and packages, and outputs them in SPDX tag-value or JSON formats. This enables C/C++ projects to integrate SBOM creation directly into their existing CMake workflows without additional tooling.

 Key features:

• Generates SPDX-compliant SBOMs during the build process.
• Outputs in SPDX tag-value or JSON formats.
• Automatically collects dependency information.
• Integrates directly with existing CMake workflows.
• Suitable for C and C++ projects of various sizes.

 GitHub: https://github.com/DEMCON/cmake-sbom

11. RunSafe Security

Description: RunSafe Security offers an SBOM solution for C and C++ projects that identifies and inventories all third-party and open-source components. It integrates with the build process to create SBOMs that meet industry standards like SPDX and CycloneDX, while also enabling vulnerability analysis and software attack surface reduction. 

Key features:

• Generates SBOMs for C and C++ projects.
• Supports SPDX and CycloneDX formats.
• Integrates with build workflows.
• Enables vulnerability detection and attack surface reduction.
• Designed for use in regulated and security-critical industries.

Website: https://runsafesecurity.com/c-c-plus-plus-sbom/ 

Useful SBOM utilities

12. BOMnipotent

Description: BOMnipotent is a command-line tool for converting SBOMs between SPDX and CycloneDX formats. It supports both JSON and XML input/output, enabling interoperability between different SBOM-producing and consuming tools. The utility can also normalize and validate SBOM content to ensure compliance with the respective specifications.

Key features:

• Converts SBOMs between SPDX and CycloneDX formats.
• Supports JSON and XML input/output.
• Normalizes and validates SBOM content.
• Enhances interoperability between SBOM tools.
• Lightweight command-line utility.

Website: https://www.bomnipotent.de/ 

13. DISTRO2SBOM

Description: DISTRO2SBOM generates SBOMs from system packaging information for installed applications or complete system installations. It supports output in SPDX and CycloneDX formats, identifying all dependent components of installed packages.

Key features:

• Generates SBOMs for installed applications or complete system installations.
• Supports output in SPDX and CycloneDX formats.
• Identifies all dependent components of installed packages.
• Supports various Linux distributions.
• Command-line interface for easy integration.

GitHub: anthonyharrison/distro2SBOM

How to choose SBOM tools

Selecting the right SBOM tool depends on your software stack, regulatory requirements, and operational needs. A good choice balances automation, compatibility, and integration to fit seamlessly into your development and security workflows. Consider the following factors:

• Input compatibility: Support for source code, binaries, containers, or system packages depending on your environment.
• Supported SBOM formats: Compatibility with formats like SPDX, CycloneDX, and SWID to ensure interoperability with other tools and systems.
• Language and ecosystem support: Ability to analyze the programming languages and package managers used in your projects.
• CI/CD integration: Ease of integration with build and deployment pipelines for automated, up-to-date SBOM generation.
• Security and license checks: Built-in analysis for known vulnerabilities and license compliance to enhance risk management.
• Scalability and enterprise features: Capacity to handle large projects or enterprise environments, with features like role-based access and central management.
• Active development and community: Ongoing updates and community support to ensure tool reliability and alignment with current standards.

Creating an SBOM with your SCA tool

If you have one, your commercial software composition analysis (SCA) tool is a great resource for SBOM generation. This isn’t a free solution, per se, but if you’re already paying for an SCA, generating SBOMs doesn’t cost you anything extra.

If you’re using Mend SCA, you can generate an SPDX or CycloneDX SBOM in a variety of formats easily from the Reports menu of the application menu bar. Additionally, you can execute the SBOM Generator Tool via CLI or as a Docker container.

This short video shows how easy it is to generate an SBOM from the Mend UI.