Sbom Cyclonedx Mcp
Generate and validate Software Bill of Materials in CycloneDX 1.6 and SPDX 2.3 from your agent before release or customer security reviews.
Overview
sbom-cyclonedx-mcp is an MCP server for the Ship phase that generates and validates SBOMs in CycloneDX 1.6 and SPDX 2.3.
What is this MCP server?
- Generates SBOMs aligned to CycloneDX 1.6
- Supports SPDX 2.3 format output and validation
- stdio Python MCP server sbom-cyclonedx-mcp v1.0.2 on PyPI
- Agent-driven validation without leaving the coding session
- CSOAI-ORG GitHub repo for supply-chain automation pipelines
- Supports CycloneDX 1.6 and SPDX 2.3 per server description
- Published version 1.0.2 on PyPI identifier sbom-cyclonedx-mcp
- stdio transport with runtimeHint python
What problem does it solve?
Hand-rolling SBOMs for every release burns time and agents cannot easily validate formats without a dedicated tool.
Who is it for?
Indie SaaS founders answering security reviews or preparing marketplace submissions with CycloneDX or SPDX.
Skip if: Projects with no third-party dependencies or teams that already automate SBOM solely in centralized CI with no agent workflow.
What do I get? / Deliverables
Your agent can produce and check standard SBOM files during security prep so you ship with auditable dependency records.
- CycloneDX 1.6 or SPDX 2.3 SBOM artifacts from agent sessions
- Validation results against those SBOM formats
- Repeatable Ship-phase SBOM step documented in agent config
Recommended MCP Servers
Journey fit
How it compares
MCP SBOM generator and validator, not a full vulnerability scanner or license legal review service.
Common Questions / FAQ
Who is sbom-cyclonedx-mcp for?
Builders shipping software who need CycloneDX or SPDX SBOMs and want their AI agent to create or validate them inline.
When should I use sbom-cyclonedx-mcp?
Use it in Ship security work before launch, customer audits, or compliance checkpoints that require SBOM evidence.
How do I add sbom-cyclonedx-mcp to my agent?
Install sbom-cyclonedx-mcp from PyPI, configure stdio MCP with runtimeHint python, and point your client at the published server entry.