tools.json

{
  "$schema": "https://cyclonedx.org/schema/tool-center-v2.schema.json",
  "specVersion": "2.0",
  "last_updated": "2026-11-05T11:03:06Z",
  "license": {
    "id": "CC-BY-SA-4.0",
    "name": "Creative Commons Attribution-ShareAlike 4.0 International",
    "url": "https://creativecommons.org/licenses/by-sa/4.0/"
  },
  "tools": [
    {
      "website_url": "https://postqsoftwarelabs.com/products.html",
      "name": "PostQ Code Scan",
      "publisher": "PostQ softwaer Labs Pvt Ltd",
      "description": "Cryptographic code analysis for source repositories, focused on finding cryptographic usage, parameters, evidence, quantum-migration relevance, FIPS assessment signals, and changes between scan",
      "capabilities": [
        "CBOM"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [],
      "platform": [
        "WINDOWS",
        "LINUX",
        "MAC"
      ],
      "lifecycle": [],
      "supportedLanguages": [
        "GO",
        "C/C++",
        "PYTHON",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT"
      ],
      "_fromFile": "PostQCodeScanner.json"
    },
    {
      "name": "action-owasp-dependecy-track-check",
      "publisher": "Quobis",
      "description": "GitHub Action that builds a CycloneDX SBOM for Node.js, Python, Go, Ruby, Java, .NET and PHP projects, converts it to v1.2 when necessary, and uploads it to an OWASP Dependency-Track server for automatic vulnerability analysis.",
      "repository_url": "https://github.com/Quobis/action-owasp-dependecy-track-check",
      "website_url": "https://github.com/Quobis/action-owasp-dependecy-track-check",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [
        "BOM_VERSION"
      ],
      "packaging": [
        "GITHUB_ACTION"
      ],
      "library": [
        "SHELL"
      ],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "supportedLanguages": [
        "NODE.JS",
        "PYTHON",
        "GO",
        "RUBY",
        "JAVA",
        ".NET",
        "PHP",
        "JAVASCRIPT/TYPESCRIPT"
      ],
      "_fromFile": "action_owasp_dependecy_track_check.json"
    },
    {
      "name": "agentgate",
      "publisher": "Zhiliang Tech",
      "description": "Control plane for the tools AI agents run: inventories MCP servers and other agent tooling, records which scanners actually ran, and never reports a partial scan as clean. CLI and GitHub Action; emits its own CycloneDX SBOM.",
      "repository_url": "https://github.com/ciceroyang/agentgate",
      "website_url": "https://app.xn--5kvo87g.com/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "AUTHOR"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "GITHUB_ACTION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [
        "JAVASCRIPT/TYPESCRIPT",
        "NODE.JS"
      ],
      "_fromFile": "agentgate.json"
    },
    {
      "name": "OWASP AIBOM Generator",
      "publisher": "OWASP GenAI Security Project",
      "description": "Generate AIBOM (AI SBOM, AI/ML-BOM) in CycloneDX format for models on Hugging Face.",
      "repository_url": "https://github.com/GenAI-Security-Project/aibom-generator",
      "website_url": "https://genai.owasp.org",
      "capabilities": [
        "AI/ML-BOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [],
      "library": [
        "PYTHON"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "_fromFile": "ai_sbom_generator.json"
    },
    {
      "name": "AIBoMGen CLI Action",
      "publisher": "IDLab, Ghent University, imec",
      "description": "A GitHub Action that generates a CycloneDX AI Bill of Materials for Hugging Face models referenced in a repository using AIBoMGen-cli.",
      "repository_url": "https://github.com/CRA-tools/aibomgen-cli-action",
      "capabilities": [
        "AI/ML-BOM",
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "packaging": [
        "GITHUB_ACTION"
      ],
      "lifecycle": [
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "_fromFile": "aibomgen-cli-action.json"
    },
    {
      "name": "AIBoMGen CLI",
      "publisher": "IDLab, Ghent University, imec",
      "description": "A Go CLI tool that scans repositories for Hugging Face model usage, generates CycloneDX AI BOMs, validates, checks completeness, enriches, and merges AIBOMs with SBOMs.",
      "repository_url": "https://github.com/idlab-discover/aibomgen-cli",
      "capabilities": [
        "AI/ML-BOM",
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT",
        "BOM_VERSION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY",
        "APPLICATION"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "supportedLanguages": [
        "PYTHON",
        "JAVASCRIPT/TYPESCRIPT"
      ],
      "_fromFile": "aibomgen-cli.json"
    },
    {
      "name": "Aikido Security",
      "publisher": "Aikido Security",
      "description": "Code-to-cloud security in one platform\u2014scan, prioritize, and fix issues across the full stack.",
      "website_url": "https://aikido.dev",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "FREEMIUM",
        "SUBSCRIPTION",
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [],
      "packaging": [
        "APPLICATION"
      ],
      "library": [],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "DESIGN",
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [
        "JAVASCRIPT/TYPESCRIPT",
        "PHP",
        "JAVA",
        "SWIFT",
        "GO",
        "PYTHON",
        ".NET",
        "RUBY",
        "RUST",
        "KOTLIN",
        "ERLANG_ELIXIR",
        "C/C++",
        "SCALA"
      ],
      "_fromFile": "aikido_security.json"
    },
    {
      "name": "Amazon Inspector SBOM Generator",
      "publisher": "Amazon Inspector",
      "description": "Amazon Inspector SBOM Generator (inspector-sbomgen) outputs CycloneDX 1.4 or SPDX 2.3 SBOMs for archives, container images, directories, local systems, and Go/Rust binaries, providing metadata for vulnerability scans with the Inspector ScanSBOM API.",
      "website_url": "https://docs.aws.amazon.com/inspector/latest/user/sbom-generator.html",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST"
      ],
      "_fromFile": "amazon_inspector_sbom_generator.json"
    },
    {
      "name": "Apiiro",
      "publisher": "Apiiro",
      "description": "Application Security Posture Management (ASPM) platform that proactively identifies and remediates critical risks in cloud-native applications across the software supply chain.",
      "website_url": "https://apiiro.com/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [],
      "packaging": [
        "APPLICATION"
      ],
      "library": [],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "DESIGN",
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [
        "JAVASCRIPT/TYPESCRIPT",
        "JAVA",
        "PYTHON",
        "GO",
        ".NET",
        "RUST"
      ],
      "_fromFile": "apiiro.json"
    },
    {
      "name": "apko",
      "publisher": "Chainguard",
      "description": "Build OCI images using APK directly without Dockerfile. Generates CycloneDX SBOMs for containers using native SBOM functionality in apk-tools v3.0 and higher.",
      "repository_url": "https://github.com/chainguard-dev/apko",
      "website_url": "https://apko.dev/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION",
        "TRANSFORM"
      ],
      "analysis": [
        "LICENSE_REPORTING",
        "RESOURCE_REPORTING"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "PYTHON",
        "RUST"
      ],
      "_fromFile": "apko.json"
    },
    {
      "name": "apt2sbom",
      "publisher": "Eliot Lear",
      "description": "Python tool that builds a Software Bill of Materials (SBOM) from APT and Python package information on Ubuntu systems, with CLI and HTTP interfaces.",
      "repository_url": "https://github.com/sbomtools/apt2sbom",
      "website_url": "https://github.com/sbomtools/apt2sbom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OSI_APPROVED",
        "OPEN_SOURCE"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "APPLICATION"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "DISCOVERY",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "PYTHON"
      ],
      "_fromFile": "apt2sbom.json"
    },
    {
      "name": "ARIANNA",
      "publisher": "Security Pattern",
      "description": "SBOM, HBOM and vulnerability management platform for intelligent connect devices. Show compliance to regulations and standards and manage risk across the entire product lifecycle.",
      "website_url": "https://www.securitypattern.com/arianna-security-management-platform",
      "capabilities": [
        "SBOM",
        "HBOM",
        "VDR/VEX"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "DESIGN",
        "BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CPE",
        "CYCLONEDX",
        "PACKAGE_URL",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [
        "C/C++",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "PYTHON",
        "PHP"
      ],
      "_fromFile": "arianna.json"
    },
    {
      "name": "Arnica",
      "publisher": "Arnica",
      "description": "SaaS platform that automates software supply-chain security; offers free, always-up-to-date SBOM generation in CycloneDX format plus risk analysis and CI/CD integrations.",
      "website_url": "https://www.arnica.io/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "FREEMIUM",
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "_fromFile": "arnica.json"
    },
    {
      "name": "Arsenal",
      "publisher": "Deepbits",
      "description": "Free online toolset that builds AI-powered SBOMs and SaaSBOMs for COTS, OSS, code repos and container images, then analyzes vulnerabilities, licenses and outdated components to surface software-supply-chain risk.",
      "website_url": "https://tools.deepbits.com/",
      "capabilities": [
        "SBOM",
        "SAASBOM"
      ],
      "availability": [
        "FREEMIUM",
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY"
      ],
      "_fromFile": "arsenal.json"
    },
    {
      "name": "asdf-cyclonedx",
      "publisher": "Xeed.IO, LLC",
      "description": "asdf plugin that installs and manages CycloneDX CLI versions, enabling SBOM tooling in any asdf-managed environment.",
      "repository_url": "https://github.com/xeedio/asdf-cyclonedx",
      "website_url": "https://github.com/xeedio/asdf-cyclonedx",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "SHELL"
      ],
      "platform": [
        "LINUX",
        "MAC"
      ],
      "lifecycle": [
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5"
      ],
      "_fromFile": "asdf_cyclonedx.json"
    },
    {
      "name": "Athena",
      "publisher": "Medical Aegis Inc",
      "description": "Athena is a SaaS solution for medical device makers that overlays the product development lifecycle to address risks before devices go to market.",
      "repository_url": "https://github.com/anquanscan/sec-tools",
      "website_url": "https://medicalaegis.com",
      "capabilities": [
        "SBOM",
        "SAASBOM",
        "VDR/VEX"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT",
        "BOM_VERSION"
      ],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION",
        "GITHUB_APP",
        "GITLAB_CI_TEMPLATE",
        "JENKINS_PLUGIN",
        "MAVEN_PLUGIN"
      ],
      "library": [
        "JAVA",
        "JAVASCRIPT_TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PERL",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SWIFT",
        "ERLANG_ELIXIR",
        "SCALA",
        "KOTLIN",
        "GROOVY",
        "FORTRAN"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "DESIGN",
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY",
        "DECOMMISSION"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL",
        "CPE",
        "OMNIBOR",
        "SWID",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PERL",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SWIFT",
        "ERLANG_ELIXIR",
        "SCALA",
        "KOTLIN",
        "GROOVY",
        "FORTRAN"
      ],
      "_fromFile": "athena.json"
    },
    {
      "name": "Auditjs",
      "publisher": "Sonatype",
      "description": "Audits JavaScript projects to identify known vulnerabilities and outdated package versions using the OSS Index v3 REST API",
      "repository_url": "https://github.com/sonatype-nexus-community/auditjs",
      "website_url": "https://github.com/sonatype-nexus-community/auditjs",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD"
      ],
      "supportedStandards": [],
      "cycloneDxVersion": [],
      "supportedLanguages": [
        "JAVASCRIPT/TYPESCRIPT"
      ],
      "_fromFile": "auditjs.json"
    },
    {
      "name": "Beniva Software Bill of Materials (SBOM)",
      "publisher": "Beniva",
      "description": "Beniva SBOM allows you to consume CycloneDX SBOM and Vulnerability Exploitability eXchange (VEX) within the ServiceNow platform which increases visibility of vulnerabilities and reduces time to remediate.",
      "website_url": "https://store.servicenow.com/sn_appstore_store.do#!/store/application/1f62663a1ba19dd06921a821604bcb98",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "lifecycle": [
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "_fromFile": "beniva_software_bill_of_materials_sbom_.json"
    },
    {
      "name": "Bitbucket Pipe for SBOM Generation",
      "publisher": "ShiftLeftCyber",
      "description": "Integrate this Bitbucket Pipe into your CI/CD pipeline to automatically generate a Software Bill of Materials (SBOM) for any project.",
      "repository_url": "https://github.com/shiftleftcyber/syft-bitbucket-pipe",
      "website_url": "https://shiftleftcyber.io",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "library": [
        "SHELL"
      ],
      "analysis": [],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "GITHUB_ACTION",
        "COMMAND_LINE_UTILITY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PERL",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SWIFT",
        "ERLANG_ELIXIR",
        "SCALA"
      ],
      "_fromFile": "bitbucket_pipe_for_sbom_generation.json"
    },
    {
      "name": "Black Duck",
      "publisher": "Synopsys",
      "description": "Black Duck is Synopsys\u2019 SCA platform that generates CycloneDX/SPDX SBOMs, detects open-source vulnerabilities, and automates license and policy compliance across applications, containers and CI/CD pipelines.",
      "repository_url": "https://github.com/blackducksoftware/detect",
      "website_url": "https://www.synopsys.com/software-integrity/security-testing/software-composition-analysis.html",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "SUBSCRIPTION",
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION",
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "POLICY_EVALUATION",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT",
        "BOM_VERSION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION",
        "AZURE_PIPELINE_EXTENSION",
        "JENKINS_PLUGIN",
        "APPLICATION"
      ],
      "library": [
        "JAVA",
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL",
        "CPE"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PERL",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SWIFT",
        "ERLANG_ELIXIR",
        "SCALA",
        "KOTLIN"
      ],
      "_fromFile": "black_duck.json"
    },
    {
      "name": "BlackBerry Jarvis",
      "publisher": "BlackBerry",
      "description": "Software composition analysis (SCA) and security testing solution that detects and lists open-source software and licenses in embedded systems and their cybersecurity vulnerabilities and exposures.",
      "website_url": "https://blackberry.qnx.com/en/products/security/blackberry-jarvis",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "SUBSCRIPTION",
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "POLICY_EVALUATION"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "library": [
        "C/C++",
        "JAVA"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "C/C++",
        "JAVA"
      ],
      "_fromFile": "blackberry_jarvis.json"
    },
    {
      "name": "bogrod",
      "publisher": "productaize",
      "description": "A command line tool to manage SBOM and VEX like source code and to distribute SBOMs to notaries.",
      "repository_url": "https://github.com/productaize/bogrod",
      "website_url": "https://github.com/productaize/bogrod",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OSI_APPROVED",
        "OPEN_SOURCE"
      ],
      "functions": [
        "AUTHOR",
        "ANALYSIS",
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING"
      ],
      "library": [
        "PYTHON"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [
        "PYTHON"
      ],
      "_fromFile": "bogrod.json"
    },
    {
      "name": "BOM Repository Server",
      "publisher": "CycloneDX",
      "description": "A lightweight repository server used to publish, manage, and distribute CycloneDX SBOMs.",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-bom-repo-server",
      "website_url": "https://github.com/CycloneDX/cyclonedx-bom-repo-server",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "DISTRIBUTE"
      ],
      "packaging": [
        "APPLICATION",
        "CONTAINER_IMAGE"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "_fromFile": "bom_repository_server.json"
    },
    {
      "name": "bomber",
      "publisher": "DevOps Kung Fu Mafia",
      "description": "CLI scanner that analyses CycloneDX, SPDX or Syft SBOMs for security vulnerabilities and licence issues using OSV, Sonatype OSS Index, GitHub Advisory or Snyk providers.",
      "repository_url": "https://github.com/devops-kung-fu/bomber",
      "website_url": "https://github.com/devops-kung-fu/bomber",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING"
      ],
      "transform": [],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [],
      "_fromFile": "bomber.json"
    },
    {
      "name": "bombon",
      "publisher": "nikstur",
      "description": "CLI and Nix library that generates CycloneDX v1.5 SBOMs for Nix packages, including build-time and vendored dependencies, compliant with BSI TR-03183 and US EO 14028.",
      "repository_url": "https://github.com/nikstur/bombon",
      "website_url": "https://github.com/nikstur/bombon",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "packaging": [
        "LIBRARY",
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "RUST"
      ],
      "platform": [
        "LINUX",
        "MAC"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3"
      ],
      "_fromFile": "bombon.json"
    },
    {
      "name": "BomLens",
      "publisher": "SK Telecom",
      "description": "Generates CycloneDX SBOMs from source code, containers, binaries, firmware, and HuggingFace AI models. Ingests existing CycloneDX/SPDX SBOMs and produces license and security findings and NOTICE files. CLI, web UI, and desktop app.",
      "repository_url": "https://github.com/sktelecom/bomlens",
      "website_url": "https://sktelecom.github.io/bomlens/",
      "capabilities": [
        "AI/ML-BOM",
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "LICENSE_REPORTING",
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [
        "BOM_STANDARD"
      ],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CPE",
        "CYCLONEDX",
        "PACKAGE_URL",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "C/C++",
        ".NET",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SWIFT"
      ],
      "_fromFile": "bomlens.json"
    },
    {
      "name": "BOMnipotent",
      "publisher": "Weichwerke Heidrich Software",
      "description": "A server application for managing and distributing SBOMs and CSAF documents. Integrates with tools for vulnerability scanning.",
      "website_url": "https://www.bomnipotent.de",
      "repository_url": "https://github.com/Weichwerke-Heidrich-Software/bomnipotent_doc",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "DISTRIBUTE"
      ],
      "library": [
        "SHELL"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "CPE"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [],
      "_fromFile": "bomnipotent.json"
    },
    {
      "name": "BOMSkope",
      "publisher": "Netskope",
      "description": "BOMSkope is a Software Bill of Materials manager designed to streamline the tracking of vendor components. It enables the identification and monitoring of vulnerabilities in vendor software, enhancing visibility into your overall security posture.",
      "repository_url": "https://github.com/netskopeoss/BOMSkope",
      "website_url": "https://github.com/netskopeoss/BOMSkope",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING"
      ],
      "library": [
        "PYTHON"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [],
      "_fromFile": "bomskope.json"
    },
    {
      "name": "Boostsecurity.io",
      "publisher": "Boostsecurity.io",
      "description": "AppSec Testing and Application Security Posture Management (ASPM) platform allowing detection and management of code risk with runtime cloud context and a focus on securing the full Software Supply Chain.",
      "website_url": "https://boostsecurity.io/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "COMMERCIAL_LICENSE",
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE",
        "PACKAGE_MANAGER_INTEGRATION",
        "TRANSFORM"
      ],
      "analysis": [
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS",
        "POLICY_EVALUATION",
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [
        "BOM_STANDARD"
      ],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY",
        "GITHUB_APP"
      ],
      "library": [],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "DESIGN",
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "C/C++",
        ".NET",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SWIFT"
      ],
      "_fromFile": "boostsecurity_io.json"
    },
    {
      "name": "build-info-go",
      "publisher": "JFrog",
      "description": "Open-source Go library and CLI that captures build metadata and outputs CycloneDX SBOMs for Java, Node.js, .NET, Go, Python and more.",
      "repository_url": "https://github.com/jfrog/build-info-go",
      "website_url": "https://github.com/jfrog/build-info-go",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION",
        "TRANSFORM"
      ],
      "analysis": [],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PYTHON"
      ],
      "_fromFile": "build_info_go.json"
    },
    {
      "name": "Bytesafe",
      "publisher": "Bytesafe",
      "description": "Bytesafe is a dependency firewall and SCA platform that blocks malicious packages, scans for vulnerabilities, enforces license policies, and generates CycloneDX SBOMs to secure the software supply chain.",
      "repository_url": "https://github.com/bitfront-se/bytesafe-ce",
      "website_url": "https://bytesafe.dev/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "FREEMIUM",
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION",
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION"
      ],
      "library": [],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PYTHON"
      ],
      "_fromFile": "bytesafe.json"
    },
    {
      "name": "CaPyCli - Clearing Automation for SW360",
      "publisher": "Siemens",
      "description": "CaPyCli is an MIT-licensed Python CLI that generates, compares, merges and converts CycloneDX SBOMs for several language ecosystems and maps them to a SW360 component database.",
      "repository_url": "https://github.com/sw360/capycli",
      "website_url": "https://github.com/sw360/capycli",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "PYTHON"
      ],
      "_fromFile": "capycli_clearing_automation_for_sw360.json"
    },
    {
      "name": "CAST Highlight",
      "publisher": "CAST",
      "description": "CAST Highlight automatically analyzes source code portfolios for open-source risks, cloud readiness, resiliency, green impact and technical debt, and can import CycloneDX SBOMs for instant SCA insights.",
      "website_url": "https://www.castsoftware.com/products/highlight",
      "repository_url": "https://github.com/MichaelMULLER/highlight-scan-github-action",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "SUBSCRIPTION",
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS",
        "POLICY_EVALUATION"
      ],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION"
      ],
      "library": [
        "JAVA"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "JAVA",
        ".NET",
        "NODE.JS",
        "JAVASCRIPT/TYPESCRIPT",
        "C/C++",
        "GO",
        "PYTHON",
        "PHP",
        "RUBY",
        "SCALA",
        "KOTLIN"
      ],
      "_fromFile": "cast_highlight.json"
    },
    {
      "name": "CAST SBOM Manager",
      "publisher": "CAST",
      "description": "CAST SBOM Manager automates creation, customization and maintenance of SBOMs, adds vulnerability and license insights, and exports them in CycloneDX, Excel and Word with a free tier up to 25 SBOMs.",
      "website_url": "https://www.castsoftware.com/sbommanager",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "FREEMIUM"
      ],
      "functions": [
        "AUTHOR",
        "ANALYSIS",
        "DISTRIBUTE",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "library": [
        "JAVA"
      ],
      "platform": [
        "LINUX",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "_fromFile": "cast_sbom_manager.json"
    },
    {
      "name": "cbom-tools",
      "publisher": "FIBEMATE",
      "description": "A CLI for generating Cryptographic Bill of Materials (CBOM) by scanning source repositories for cryptographic algorithm usage, producing CycloneDX 1.6 CBOM output with schema validation.",
      "repository_url": "https://github.com/Lennonhaha/fibemate-tools",
      "website_url": "https://github.com/Lennonhaha/fibemate-tools/tree/main/cbom-tools#readme",
      "capabilities": [
        "CBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "supportedLanguages": [
        "JAVASCRIPT/TYPESCRIPT",
        "C/C++",
        "PYTHON"
      ],
      "_fromFile": "cbom-tools.json"
    },
    {
      "name": "cbom-generator",
      "publisher": "CipherIQ",
      "description": "Static cryptographic asset scanner for Linux systems. Discovers algorithms, keys, certificates, and crypto libraries. Generates CycloneDX 1.6/1.7 CBOM with PQC readiness classification for 48+ NIST algorithms.",
      "repository_url": "https://github.com/CipherIQ/cbom-generator",
      "website_url": "https://cipheriq.io",
      "capabilities": [
        "CBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED",
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION"
      ],
      "library": [
        "C/C++"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.7"
      ],
      "_fromFile": "cbom_generator_cipheriq.json"
    },
    {
      "name": "CBOM-Lens",
      "publisher": "OmniTrust",
      "description": "Discovers certificates, keys, secrets, and algorithms on local systems, in container images, and on network services, generating a CycloneDX 1.6 or 1.7 CBOM. Detects post-quantum algorithms and emits the 1.7 algorithmFamily and ellipticCurve fields.",
      "repository_url": "https://github.com/OmniTrustILM/cbom-lens",
      "website_url": "https://omnitrust.com",
      "capabilities": [
        "CBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6"
      ],
      "_fromFile": "cbom_lens.json"
    },
    {
      "name": "CBOM-Repository",
      "publisher": "OmniTrust",
      "description": "REST API service for storing, versioning, retrieving, and searching CycloneDX CBOM documents on S3-compatible object storage. Assigns serial numbers and versions when missing. Deployed as a container image or Helm chart.",
      "repository_url": "https://github.com/OmniTrustILM/cbom-repository",
      "website_url": "https://omnitrust.com",
      "capabilities": [
        "CBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "DISTRIBUTE"
      ],
      "packaging": [
        "APPLICATION",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6"
      ],
      "_fromFile": "cbom_repository.json"
    },
    {
      "name": "CBOM Viewer",
      "publisher": "IBM",
      "description": "A Web Service to visualize and explore the use of cryptography in software with Cryptography Bills of Materials (CBOM).",
      "website_url": "https://www.zurich.ibm.com/cbom/",
      "repository_url": "https://www.zurich.ibm.com/cbom/",
      "capabilities": [
        "CBOM"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "PYTHON"
      ],
      "_fromFile": "cbom_viewer.json"
    },
    {
      "name": "NextGenRails CBOM Compliance",
      "publisher": "NextGenRails",
      "description": "Assesses cryptographic assets declared in a CycloneDX or SPDX manifest against NIST IR 8547 and the EO 14412 deadlines, then issues an offline-verifiable receipt dual-signed RS256 + ML-DSA-65 (FIPS 204). Free, uncapped check; nothing retained.",
      "website_url": "https://cbomcompliance.com",
      "capabilities": [
        "CBOM",
        "SBOM"
      ],
      "availability": [
        "FREEMIUM",
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "SIGNING/NOTARY"
      ],
      "analysis": [
        "POLICY_EVALUATION",
        "SECURITY_VULNERABILITIES"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5"
      ],
      "_fromFile": "cbomcompliance.json"
    },
    {
      "name": "cbomctl",
      "publisher": "Sadjad Asadi",
      "description": "Evaluates a CycloneDX CBOM against seven national post-quantum policies at once (BSI, ANSSI, ASD, CNSA 2.0, EO 14412, EU roadmap, NIST IR 8547) and reports where their verdicts contradict. Every rule cites a primary source and a verification date.",
      "repository_url": "https://github.com/lvlrSajjad/cbomctl",
      "website_url": "https://lvlrsajjad.github.io/cbomctl/",
      "capabilities": [
        "CBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "POLICY_EVALUATION"
      ],
      "transform": [],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "GITHUB_ACTION"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [],
      "_fromFile": "cbomctl.json"
    },
    {
      "name": "CBOMkit",
      "publisher": "IBM",
      "description": "CBOMkit is a toolset for generating, viewing, checking, and storing Cryptography Bills of Materials (CBOM).",
      "repository_url": "https://github.com/IBM/cbomkit",
      "website_url": "https://github.com/IBM/cbomkit",
      "capabilities": [
        "CBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION"
      ],
      "library": [
        "JAVA"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "JAVA",
        "PYTHON"
      ],
      "_fromFile": "cbomkit.json"
    },
    {
      "name": "CBOMkit-theia",
      "publisher": "IBM",
      "description": "A tool that detects cryptographic assets in container images and directories, generating CBOMs.",
      "repository_url": "https://github.com/IBM/cbomkit-theia",
      "website_url": "https://github.com/IBM/cbomkit-theia",
      "capabilities": [
        "CBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "RESOURCE_REPORTING"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "PYTHON"
      ],
      "_fromFile": "cbomkit_theia.json"
    },
    {
      "name": "cdx-central",
      "publisher": "nscuro",
      "description": "CLI utility that downloads public CycloneDX SBOMs from Maven Central for selected artifacts.",
      "repository_url": "https://github.com/nscuro/cdx-central",
      "website_url": "https://github.com/nscuro/cdx-central",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "DISTRIBUTE"
      ],
      "analysis": [],
      "transform": [],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [],
      "_fromFile": "cdx_central.json"
    },
    {
      "name": "cdx-enrich",
      "publisher": "Michael Tsfoni",
      "description": "Enriches a CycloneDX Software Bills of Material (SBOM) with predefined data.",
      "repository_url": "https://github.com/mtsfoni/cdx-enrich",
      "website_url": "https://github.com/mtsfoni/cdx-enrich",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "TRANSFORM"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "C#",
        ".NET"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PERL",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SWIFT",
        "ERLANG_ELIXIR",
        "SCALA"
      ],
      "_fromFile": "cdx_enrich.json"
    },
    {
      "name": "cdx-vs-cdx",
      "publisher": "marcosanchotene",
      "description": "GTK-style Python GUI that compares two CycloneDX JSON SBOMs, highlighting components unique to each file and those present in both.",
      "repository_url": "https://github.com/marcosanchotene/cdx-vs-cdx",
      "website_url": "https://github.com/marcosanchotene/cdx-vs-cdx",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "_fromFile": "cdx_vs_cdx.json"
    },
    {
      "name": "cdxgen",
      "publisher": "CycloneDX",
      "description": "Universal polyglot CLI, library and server that generates CycloneDX SBOMs\u2014including SaaSBOM, OBOM and CBOM variants\u2014for source code, container images and cloud resources.",
      "repository_url": "https://github.com/CycloneDX/cdxgen",
      "website_url": "https://cyclonedx.github.io/cdxgen/",
      "capabilities": [
        "SBOM",
        "SAASBOM",
        "CBOM",
        "OBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION",
        "SIGNING/NOTARY"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT",
        "BOM_VERSION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION",
        "LIBRARY"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT",
        "NODE.JS"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST"
      ],
      "_fromFile": "cdxgen.json"
    },
    {
      "name": "Celmis",
      "publisher": "Celmis Labs",
      "description": "Self-hosted code intelligence. Indexes repositories into a symbol graph and audits dependencies deterministically \u2014 each ecosystem's native auditor, OSV-Scanner for the rest. Exports a CycloneDX 1.5 SBOM and an evidence pack of sha256 digests.",
      "repository_url": "https://github.com/Celmis-labs/Celmis",
      "website_url": "https://celmis-labs.github.io",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "OUTDATED_COMPONENTS",
        "RESOURCE_REPORTING"
      ],
      "packaging": [
        "CONTAINER_IMAGE",
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [
        ".NET",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST"
      ],
      "_fromFile": "celmis.json"
    },
    {
      "name": "CertNotify SBOM Viewer",
      "publisher": "CertNotify",
      "description": "Free web viewer for CycloneDX and SPDX JSON SBOMs. Lists every component, version and license by ecosystem, and flags gaps such as missing versions or purls. Parsed in the browser; nothing is uploaded.",
      "website_url": "https://www.certnotify.com/tools/sbom-viewer",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "FREEMIUM"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "_fromFile": "certnotify_sbom_viewer.json"
    },
    {
      "name": "Chainloop",
      "publisher": "Chainloop",
      "description": "Chainloop is an Open Source evidence store for your Software Supply Chain attestations, SBOMs, VEX, QA reports, and more.",
      "repository_url": "https://github.com/chainloop-dev/chainloop",
      "website_url": "https://github.com/chainloop-dev/chainloop",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "DISTRIBUTE",
        "PACKAGE_MANAGER_INTEGRATION",
        "SIGNING/NOTARY"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION"
      ],
      "transform": [],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "PYTHON"
      ],
      "_fromFile": "chainloop.json"
    },
    {
      "name": "Checkov",
      "publisher": "Checkov",
      "description": "Prevent cloud misconfigurations during build-time for Terraform, Cloudformation, Kubernetes, Serverless framework and other infrastructure-as-code-languages with Checkov by Bridgecrew. Can output to CycloneDX.",
      "repository_url": "https://github.com/bridgecrewio/checkov",
      "website_url": "https://www.checkov.io/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "platform": [
        "WINDOWS",
        "LINUX",
        "MAC"
      ],
      "lifecycle": [
        "BUILD",
        "PRE-BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "_fromFile": "checkov.json"
    },
    {
      "name": "Chelsea",
      "publisher": "Sonatype",
      "description": "Dependency vulnerability auditor for Ruby",
      "repository_url": "https://github.com/sonatype-nexus-community/chelsea",
      "website_url": "https://github.com/sonatype-nexus-community/chelsea",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "RUBY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD"
      ],
      "supportedStandards": [],
      "cycloneDxVersion": [],
      "supportedLanguages": [
        "RUBY"
      ],
      "_fromFile": "chelsea.json"
    },
    {
      "name": "CipherMap",
      "publisher": "Ciphermap Technologies LLC",
      "description": "Offline zero-egress 12-language post-quantum cryptography (PQC) scanner and CycloneDX 1.6 CBOM generator with composite Ed25519 + ML-DSA-65 provenance, NIST FIPS 203/204/205 & CNSA 2.0 policy gates, and local MCP referee.",
      "website_url": "https://www.ciphermap.io",
      "capabilities": [
        "CBOM"
      ],
      "availability": [
        "FREEMIUM",
        "COMMERCIAL_LICENSE",
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "SIGNING/NOTARY"
      ],
      "analysis": [
        "POLICY_EVALUATION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "C/C++",
        ".NET",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "KOTLIN",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SWIFT"
      ],
      "_fromFile": "ciphermap.json"
    },
    {
      "name": "ClaveQ Scan",
      "publisher": "ClaveQ",
      "description": "Passive cryptographic discovery for OT and critical infrastructure \u2014 classifies quantum-vulnerable vs quantum-safe cryptography in use, sends zero packets onto the monitored network, no agents, and outputs a schema-validated CycloneDX 1.7 CBOM.",
      "website_url": "https://www.claveq.com",
      "capabilities": [
        "CBOM"
      ],
      "availability": [
        "FREEMIUM"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY"
      ],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "DISCOVERY",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7"
      ],
      "_fromFile": "claveq_scan.json"
    },
    {
      "name": "Clearlane CRA",
      "publisher": "Clearlane Apps",
      "description": "Jira Cloud app for EU Cyber Resilience Act work: imports CycloneDX and SPDX JSON SBOMs per product version, finds the versions that contain a given component or version range, tracks Article 14 deadlines and exports CSAF 2.0 advisories.",
      "website_url": "https://clearlaneapps.com/cra/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "COMMERCIAL_LICENSE",
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.6"
      ],
      "_fromFile": "clearlane_cra.json"
    },
    {
      "name": "ClickBOM",
      "publisher": "ClickHouse",
      "description": "Downloads and merges SBOMs from various sources. Converts to CycloneDX and SPDX formats. Uploads to cloud storage and ClickHouse for analytics.",
      "repository_url": "https://github.com/ClickHouse/ClickBOM",
      "website_url": "https://github.com/marketplace/actions/clickbom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE",
        "TRANSFORM"
      ],
      "packaging": [
        "GITHUB_ACTION"
      ],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "BUILD",
        "DISCOVERY",
        "OPERATIONS",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "_fromFile": "clickbom.json"
    },
    {
      "name": "CodeNotary CAS",
      "publisher": "CodeNotary",
      "description": "CAS is an open source attestation service for the community. Notarize and authorize files, directories, git repos and Build SBOMs of containers.",
      "repository_url": "https://github.com/codenotary/cas",
      "website_url": "https://cas.codenotary.com/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "SIGNING/NOTARY"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "_fromFile": "codenotary_cas.json"
    },
    {
      "name": "Codenotary CAS Authenticate Docker Image and SBOM",
      "publisher": "Codenotary",
      "description": "A GitHub Action which authenticates notarized Docker images and SBOMs.",
      "repository_url": "https://github.com/codenotary/cas-authenticate-docker-bom-github-action",
      "website_url": "https://cas.codenotary.com/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "SIGNING/NOTARY"
      ],
      "packaging": [
        "GITHUB_ACTION"
      ],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "_fromFile": "codenotary_cas_authenticate_docker_image_and_sbom.json"
    },
    {
      "name": "Codenotary CAS Notarize Docker Image and SBOM",
      "publisher": "Codenotary",
      "description": "A GitHub Action which notarizes and creates an SBOM for Docker images.",
      "repository_url": "https://github.com/codenotary/cas-notarize-docker-image-bom-github-action",
      "website_url": "https://cas.codenotary.com/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "SIGNING/NOTARY"
      ],
      "packaging": [
        "GITHUB_ACTION"
      ],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "_fromFile": "codenotary_cas_notarize_docker_image_and_sbom.json"
    },
    {
      "name": "Codenotary vcn",
      "publisher": "Codenotary",
      "description": "Protects an organization's software development pipeline from supply chain attacks. Codenotary natively supports CycloneDX SBOMs.",
      "repository_url": "https://github.com/codenotary/vcn",
      "website_url": "https://codenotary.com/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "SIGNING/NOTARY"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "_fromFile": "codenotary_vcn.json"
    },
    {
      "name": "CodeSentry",
      "publisher": "GrammaTech",
      "description": "Software Composition Analysis (SCA) platform that leverages binary analysis to identify components, inherited risk, and communicates inventory through CycloneDX SBOMs",
      "website_url": "https://www.grammatech.com",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "_fromFile": "codesentry.json"
    },
    {
      "name": "Complioty",
      "publisher": "Complioty GmbH",
      "description": "Cloud platform for product security and Cyber Resilience Act (CRA) compliance of machinery manufacturers. Ingests CycloneDX SBOMs and HBOMs, monitors vulnerabilities and publishes CSAF 2.0 advisories and VEX.",
      "website_url": "https://complioty.de",
      "capabilities": [
        "SBOM",
        "HBOM",
        "OBOM",
        "VDR/VEX"
      ],
      "availability": [
        "SUBSCRIPTION",
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "OUTDATED_COMPONENTS",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "lifecycle": [
        "DESIGN",
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "CPE",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5"
      ],
      "_fromFile": "complioty.json"
    },
    {
      "name": "Complioty Scanner",
      "publisher": "Complioty GmbH",
      "description": "Desktop app that builds CycloneDX SBOMs and HBOMs of industrial machines from PLC projects (TIA Portal, CODESYS, Rockwell, B&R), diagnostic exports, Windows and Linux IPC/HMI images and network scans, and uploads them to Complioty.",
      "website_url": "https://complioty.de/en/apps/scanner/",
      "capabilities": [
        "SBOM",
        "HBOM",
        "OBOM"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "DISTRIBUTE"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "CPE",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5"
      ],
      "_fromFile": "complioty_scanner.json"
    },
    {
      "name": "Conformesh",
      "publisher": "Conformesh",
      "description": "A CI/CD command-line and container integration that uploads an existing CycloneDX SBOM and other build evidence to a product-scoped Conformesh account, then returns the product's current CRA dossier-readiness result.",
      "repository_url": "https://github.com/conformesh/conformesh-pipeline-cli",
      "website_url": "https://conformesh.com/how-to",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "DISTRIBUTE"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.6"
      ],
      "_fromFile": "conformesh.json"
    },
    {
      "name": "Continuous Clearing",
      "publisher": "Siemens",
      "description": "Scans third-party OSS components in NPM, NuGet, Maven, Python and Debian projects, generates CycloneDX SBOMs, then uploads them to SW360 and Fossology for automated license clearing.",
      "repository_url": "https://github.com/siemens/continuous-clearing",
      "website_url": "https://github.com/siemens/continuous-clearing",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        ".NET"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "supportedLanguages": [
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "PYTHON"
      ],
      "_fromFile": "continuous_clearing.json"
    },
    {
      "name": "Contrast Security",
      "publisher": "Contrast Security",
      "description": "Automatically generates component inventory from runtime analysis (IAST or RASP) and generates CycloneDX SBOMs",
      "website_url": "https://www.contrastsecurity.com/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "COMMERCIAL_LICENSE",
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "RESOURCE_REPORTING"
      ],
      "packaging": [
        "APPLICATION",
        "LIBRARY",
        "GITHUB_ACTION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "supportedLanguages": [
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "NODE.JS",
        ".NET",
        "PYTHON",
        "GO",
        "PHP",
        "RUBY"
      ],
      "_fromFile": "contrast_security.json"
    },
    {
      "name": "Conviso Platform",
      "publisher": "Conviso",
      "description": "Conviso Platform includes an SCA engine that detects multi-language ecosystems, generates CycloneDX/SPDX SBOMs, enriches results with vulnerabilities and licenses, and provides supply chain visibility.",
      "website_url": "https://www.convisoappsec.com/conviso-platform",
      "capabilities": [
        "SBOM",
        "MBOM"
      ],
      "availability": [
        "COMMERCIAL_LICENSE",
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION",
        "TRANSFORM",
        "SIGNING/NOTARY"
      ],
      "analysis": [
        "LICENSE_REPORTING",
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [
        "BOM_STANDARD"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [
        "PYTHON",
        "NODE.JS",
        "JAVASCRIPT/TYPESCRIPT",
        "JAVA",
        ".NET",
        "GO",
        "RUST",
        "RUBY",
        "PHP",
        "ERLANG_ELIXIR"
      ],
      "_fromFile": "conviso-platform.json"
    },
    {
      "name": "Cosign",
      "publisher": "Sigstore",
      "description": "Container Signing, Verification and Storage in an OCI registry, including CycloneDX SBOMs",
      "repository_url": "https://github.com/sigstore/cosign",
      "website_url": "https://sigstore.dev/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "SIGNING/NOTARY",
        "DISTRIBUTE"
      ],
      "library": [
        "GO"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "_fromFile": "cosign.json"
    },
    {
      "name": "Covenant",
      "publisher": "Patrik Svensson",
      "description": "Command-line tool that creates SBOMs from .NET and NPM projects or existing CycloneDX BOMs, outputting CycloneDX or SPDX formats.",
      "repository_url": "https://github.com/patriksvensson/covenant",
      "website_url": "https://github.com/patriksvensson/covenant",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "TRANSFORM"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_STANDARD"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        ".NET"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "supportedLanguages": [
        ".NET",
        "JAVASCRIPT/TYPESCRIPT",
        "NODE.JS"
      ],
      "_fromFile": "covenant.json"
    },
    {
      "name": "CRA Release Evidence",
      "publisher": "Warnowdigitalsolutions",
      "description": "GitHub Action that imports CycloneDX SBOMs and packages them with existing test, security, and Git data into versioned Markdown and JSON release evidence. It does not scan or make compliance decisions.",
      "repository_url": "https://github.com/mastermuetze/cra-release-evidence",
      "website_url": "https://github.com/marketplace/actions/cra-release-evidence",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "DISTRIBUTE"
      ],
      "packaging": [
        "GITHUB_ACTION"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT"
      ],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "_fromFile": "cra_release_evidence.json"
    },
    {
      "name": "CRACI",
      "publisher": "CRACI Corporation Oy",
      "description": "GitHub Actions runners that record an SBOM of every dependency a job pulls in while the build runs, not a scan afterwards. Exports CycloneDX and SPDX, signs build provenance and monitors shipped SBOMs for new vulnerabilities.",
      "website_url": "https://craci.com/features/sbom-generation",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION",
        "ANALYSIS",
        "DISTRIBUTE",
        "SIGNING/NOTARY"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "POLICY_EVALUATION"
      ],
      "packaging": [
        "GITHUB_APP"
      ],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "supportedLanguages": [
        "GO",
        "JAVASCRIPT/TYPESCRIPT",
        "NODE.JS",
        "PYTHON",
        "RUBY",
        "RUST"
      ],
      "_fromFile": "craci.json"
    },
    {
      "name": "CRA Desk Scan",
      "publisher": "CRA Desk",
      "description": "Turns a CycloneDX or SPDX JSON SBOM into an EU Cyber Resilience Act (CRA) readiness report: scope verdict and product class with article citations, plus a cited checklist. GitHub Action, GitLab CI component or npx CLI.",
      "repository_url": "https://github.com/mmalinowski/cradesk-action",
      "website_url": "https://cradesk.eu",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "POLICY_EVALUATION"
      ],
      "transform": [],
      "packaging": [
        "GITHUB_ACTION",
        "GITLAB_CI_TEMPLATE",
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT"
      ],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [],
      "_fromFile": "cradesk_scan.json"
    },
    {
      "name": "CRA Label SBOM Action",
      "publisher": "CRA Label",
      "description": "A GitHub Action that builds CycloneDX 1.6 and SPDX 2.3 SBOMs from the dependency files in a repository inside the runner, and adds an ML-DSA-65-signed attestation over their hashes. Source code and lockfiles stay in the runner.",
      "repository_url": "https://github.com/Shauliko/cralabel-sbom-action",
      "website_url": "https://github.com/marketplace/actions/cra-label-sbom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "SIGNING/NOTARY"
      ],
      "packaging": [
        "GITHUB_ACTION"
      ],
      "library": [
        "NODE.JS"
      ],
      "platform": [
        "LINUX",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "NODE.JS",
        "JAVASCRIPT/TYPESCRIPT",
        "PYTHON",
        "GO",
        "RUST",
        "JAVA",
        "RUBY",
        "PHP"
      ],
      "_fromFile": "cralabel-sbom-action.json"
    },
    {
      "name": "CRA Label SBOM Generator",
      "publisher": "CRA Label",
      "description": "A free web tool that turns a manifest or lockfile (npm, PyPI, Go, Cargo, Maven, RubyGems, Composer) into CycloneDX 1.6 and SPDX 2.3 SBOMs with package-URLs and an ML-DSA-65-signed attestation. It needs no account and keeps no copy of the file.",
      "website_url": "https://cralabel.com/sbom.html",
      "capabilities": [
        "SBOM"
      ],
      "functions": [
        "SIGNING/NOTARY"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "NODE.JS",
        "JAVASCRIPT/TYPESCRIPT",
        "PYTHON",
        "GO",
        "RUST",
        "JAVA",
        "RUBY",
        "PHP"
      ],
      "_fromFile": "cralabel.json"
    },
    {
      "name": "CRYPTAGION",
      "publisher": "KOR IT",
      "description": "Cryptographic discovery and post-quantum migration. Scans source code, X.509 certificates and live TLS endpoints, scores quantum risk and exports a CycloneDX 1.6 CBOM, a migration roadmap and a report. Runs on-prem or air-gapped.",
      "website_url": "https://www.cryptagion.io",
      "capabilities": [
        "CBOM"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "POLICY_EVALUATION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "platform": [
        "LINUX",
        "MAC"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "PYTHON",
        "JAVASCRIPT/TYPESCRIPT",
        "JAVA",
        "GO",
        "C/C++"
      ],
      "_fromFile": "cryptagion.json"
    },
    {
      "name": "cudabom",
      "publisher": "Chris Peoples",
      "description": "CLI that identifies NVIDIA CUDA software inside Python wheels, shared libraries, executables, and container images, then emits CycloneDX SBOMs and VEX mapped to NVIDIA security bulletins.",
      "repository_url": "https://github.com/cpeoples/cudabom",
      "website_url": "https://github.com/cpeoples/cudabom",
      "capabilities": [
        "SBOM",
        "AI/ML-BOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "library": [
        "RUST"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "PYTHON",
        "C/C++",
        "RUST"
      ],
      "_fromFile": "cudabom.json"
    },
    {
      "name": "CVD Portal SBOM Validator",
      "publisher": "Porta Regulus B.V.",
      "description": "Free hosted validator that checks a CycloneDX or SPDX document against BSI TR-03183-2 and reports pass or fail for each requirement with its clause reference, including the specification version minimum. No signup.",
      "website_url": "https://cvdportal.com/tools/sbom-validator",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "FREEMIUM"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "POLICY_EVALUATION"
      ],
      "transform": [],
      "packaging": [],
      "library": [],
      "platform": [],
      "lifecycle": [
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.2",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.7"
      ],
      "supportedLanguages": [],
      "_fromFile": "cvd_portal_sbom_validator.json"
    },
    {
      "name": "cve-bin-tool",
      "publisher": "Intel",
      "description": "Command-line scanner that identifies vulnerable components in binaries, accepts/generates SBOMs, and reports CVEs. Supports 400+ checkers for open source libraries with CycloneDX output.",
      "repository_url": "https://github.com/intel/cve-bin-tool",
      "website_url": "https://cve-bin-tool.readthedocs.io/en/latest/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "CPE",
        "SPDX",
        "SWID"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "C/C++",
        "PYTHON",
        "JAVASCRIPT/TYPESCRIPT",
        "ERLANG_ELIXIR",
        "GO",
        "RUST"
      ],
      "_fromFile": "cve_bin_tool.json"
    },
    {
      "name": "CVE Scan",
      "publisher": "The Embedded Kit",
      "description": "Detect and mitigate vulnerabilities in embedded systems. Generate SBOMs, cross-reference public databases, integrate with CI pipelines, and use filtering/annotations for streamlined security maintenance.",
      "website_url": "https://theembeddedkit.io/cve-scan-linux-vulnerability-scanner/",
      "repository_url": "https://theembeddedkit.io/cve-scan-linux-vulnerability-scanner/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "C/C++",
        "PYTHON",
        "JAVASCRIPT/TYPESCRIPT"
      ],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "_fromFile": "cve_scan.json"
    },
    {
      "name": "CxSCA",
      "publisher": "Checkmarx",
      "description": "Software Composition Analysis (SCA) platform that identifies vulnerabilities, malicious code, and license risks in open-source libraries with exploitable path analysis and SBOM generation capabilities.",
      "website_url": "https://checkmarx.com/cxsca-open-source-scanning/",
      "repository_url": "https://checkmarx.com/cxsca-open-source-scanning/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "COMMERCIAL_LICENSE",
        "FREEMIUM"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST"
      ],
      "_fromFile": "cxsca.json"
    },
    {
      "name": "Cybeats SBOM Studio",
      "publisher": "Cybeats Technologies Inc.",
      "description": "Enterprise solution to manage SBOMs at scale and proactively discover and reduce risk across the entire software supply chain, from development through deployment.",
      "repository_url": "https://github.com/cybeats",
      "website_url": "https://www.cybeats.com/product/sbom-studio",
      "capabilities": [
        "SBOM",
        "SAASBOM",
        "VDR/VEX"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "AUTHOR",
        "ANALYSIS",
        "TRANSFORM",
        "PACKAGE_MANAGER_INTEGRATION",
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "RESOURCE_REPORTING",
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "APPLICATION",
        "GITHUB_ACTION"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PYTHON",
        "RUBY",
        "RUST"
      ],
      "_fromFile": "cybeats_sbom_studio.json"
    },
    {
      "name": "Cybellum SBOM",
      "publisher": "Cybellum Technologies LTD.",
      "description": "Analyzes binary artifacts to generate SBOMs including context-based analysis to perform accurate vulnerability assessment",
      "website_url": "https://cybellum.com",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "COMMERCIAL_LICENSE",
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "RESOURCE_REPORTING"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "_fromFile": "cybellum_sbom.json"
    },
    {
      "name": "Cyberwatch",
      "publisher": "Cyberwatch",
      "description": "Cyberwatch Vulnerability Manager allows you to discover assets, scan and prioritize vulnerabilities, and fix them.",
      "repository_url": "https://cyberwatch.fr/en/",
      "website_url": "https://cyberwatch.fr/en/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [
        ".NET",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "PYTHON"
      ],
      "_fromFile": "cyberwatch.json"
    },
    {
      "name": "CycloneDX BOM Studio",
      "publisher": "OWASP Foundation",
      "description": "A visual editor for creating and managing CycloneDX Bills of Materials. BOM Studio lets you create, edit, validate, and export CycloneDX BOMs through an intuitive browser\u2011based web interface.",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-bom-studio",
      "website_url": "https://cyclonedx.studio/",
      "capabilities": [
        "AI/ML-BOM",
        "CBOM",
        "HBOM",
        "OBOM",
        "SAASBOM",
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "AUTHOR",
        "ANALYSIS"
      ],
      "analysis": [],
      "transform": [
        "BOM_VERSION"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "library": [],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL",
        "CPE"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [],
      "_fromFile": "cyclonedx-bom-studio.json"
    },
    {
      "name": "cyclonedx-cr",
      "publisher": "hahwul",
      "description": "A Crystal tool for generating CycloneDX SBOMs from Crystal shard projects, reading shard.yml and shard.lock to produce JSON, XML, or CSV output with canonical PURLs.",
      "repository_url": "https://github.com/hahwul/cyclonedx-cr",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "LIBRARY"
      ],
      "platform": [
        "LINUX",
        "MAC"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.6"
      ],
      "_fromFile": "cyclonedx-cr.json"
    },
    {
      "name": "CycloneDX-Buildroot",
      "publisher": "CycloneDX",
      "description": "Python application that generates CycloneDX Software Bill of Materials (SBOM) for Buildroot-generated projects and other projects with CSV manifest files",
      "repository_url": "https://github.com/cyclonedx/cyclonedx-buildroot",
      "website_url": "https://pypi.org/project/cyclonedx-buildroot/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT",
        "BOM_VERSION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "C/C++"
      ],
      "_fromFile": "cyclonedx_buildroot.json"
    },
    {
      "name": "CycloneDX CLI",
      "publisher": "CycloneDX",
      "description": "CLI tool for SBOM analysis, merging, diffs, format conversions, signing, and validation. Supports CycloneDX XML/JSON/Protobuf/CSV, SPDX JSON, and more.",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-cli",
      "website_url": "https://cyclonedx.org/",
      "capabilities": [
        "SBOM",
        "SAASBOM",
        "OBOM",
        "MBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM",
        "SIGNING/NOTARY"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT",
        "BOM_VERSION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        ".NET"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2",
        "CYCLONEDX_V1.1",
        "CYCLONEDX_V1.0"
      ],
      "supportedLanguages": [],
      "_fromFile": "cyclonedx_cli.json"
    },
    {
      "name": "CycloneDX Core for Java",
      "publisher": "OWASP Foundation (CycloneDX Project)",
      "description": "Java library for creating, parsing, and validating CycloneDX SBOMs.",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-core-java",
      "website_url": "https://cyclonedx.github.io/cyclonedx-core-java/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "packaging": [
        "LIBRARY"
      ],
      "library": [
        "JAVA"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "supportedLanguages": [
        "JAVA"
      ],
      "_fromFile": "cyclonedx_core_for_java.json"
    },
    {
      "name": "cyclonedx_deps_to_mermaid.xsl",
      "publisher": "Jan Kowalleck",
      "description": "Extensible Stylesheet Language Transformations (XSLT) to translate CycloneDX dependency graph to mermaid chart.",
      "repository_url": "https://gist.github.com/jkowalleck/a0f874ee0a8af9a56a0e887631fc53d1",
      "website_url": "https://gist.github.com/jkowalleck/a0f874ee0a8af9a56a0e887631fc53d1",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "TRANSFORM"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "supportedLanguages": [
        "JAVASCRIPT/TYPESCRIPT",
        "JAVA",
        "PHP"
      ],
      "_fromFile": "cyclonedx_deps_to_mermaid_xsl.json"
    },
    {
      "name": "cyclonedx-editor-validator",
      "publisher": "Festo SE & Co. KG",
      "description": "Command-line utility to create, merge, edit and validate CycloneDX SBOMs and VEX files for automated CI/CD workflows.",
      "repository_url": "https://github.com/Festo-se/cyclonedx-editor-validator",
      "website_url": "https://festo-se.github.io/cyclonedx-editor-validator/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "AUTHOR",
        "ANALYSIS"
      ],
      "analysis": [
        "POLICY_EVALUATION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SWIFT"
      ],
      "_fromFile": "cyclonedx_editor_validator.json"
    },
    {
      "name": "cyclonedx-enrich",
      "publisher": "fnxpt",
      "description": "Enrich CycloneDX SBOM files by applying enrichers to improve data quality, including licenses, hashes, properties, and references.",
      "repository_url": "https://github.com/fnxpt/cyclonedx-enrich",
      "website_url": "https://github.com/fnxpt/cyclonedx-enrich",
      "capabilities": [
        "SBOM",
        "CBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "PYTHON",
        "RUBY"
      ],
      "_fromFile": "cyclonedx_enrich.json"
    },
    {
      "name": "CycloneDX for Apache Ant",
      "publisher": "The Apache Software Foundation / Apache Ant Project",
      "description": "Library of Apache Ant tasks and types support the generation of CycloneDX SBOMs (JSON or XML) for Java projects",
      "repository_url": "https://gitbox.apache.org/repos/asf/ant-antlibs-cyclonedx.git",
      "website_url": "https://ant.apache.org/antlibs/cyclonedx/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT",
        "BOM_VERSION"
      ],
      "packaging": [
        "LIBRARY"
      ],
      "library": [
        "JAVA"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "supportedLanguages": [
        "JAVA"
      ],
      "_fromFile": "cyclonedx_for_ant.json"
    },
    {
      "name": "CycloneDX for Bower",
      "publisher": "Hans Thorhauge Dam",
      "description": "Creates CycloneDX Software Bill of Materials (SBOM) from JavaScript projects that manage dependencies with Bower.",
      "repository_url": "https://github.com/hanstdam/cdx-bower-bom",
      "website_url": "https://www.npmjs.com/package/cdx-bower-bom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [
        "JAVASCRIPT/TYPESCRIPT"
      ],
      "_fromFile": "cyclonedx_for_bower.json"
    },
    {
      "name": "CycloneDX for Cocoapods",
      "publisher": "CycloneDX",
      "description": "Creates CycloneDX SBOMs for Objective-C and Swift projects that use CocoaPods.",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-cocoapods",
      "website_url": "https://github.com/CycloneDX/cyclonedx-cocoapods",
      "capabilities": [
        "SBOM",
        "OBOM",
        "MBOM",
        "SAASBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "TRANSFORM"
      ],
      "analysis": [],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT",
        "BOM_VERSION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "library": [
        "RUBY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "SWIFT"
      ],
      "_fromFile": "cyclonedx_for_cocoapods.json"
    },
    {
      "name": "CycloneDX for Conan1",
      "publisher": "CycloneDX",
      "description": "Creates CycloneDX Software Bill of Materials (SBOM) for C/C++ projects using Conan1 (note: considered deprecated)",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-conan",
      "website_url": "https://pypi.org/project/cyclonedx-conan/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "platform": [
        "WINDOWS",
        "LINUX",
        "MAC"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.3"
      ],
      "library": [
        "PYTHON"
      ],
      "supportedLanguages": [
        "C/C++"
      ],
      "_fromFile": "cyclonedx_for_conan1.json"
    },
    {
      "name": "CycloneDX for Conan2",
      "publisher": "Conan-IO",
      "description": "Creates CycloneDX Software Bill of Materials (SBOM) for C/C++ projects using Conan2",
      "repository_url": "https://github.com/conan-io/conan-extensions",
      "website_url": "https://github.com/conan-io/conan-extensions/tree/main/extensions/commands/sbom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "packaging": [
        "CONAN_EXTENSION",
        "COMMAND_LINE_UTILITY"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "platform": [
        "WINDOWS",
        "LINUX",
        "MAC"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2",
        "CYCLONEDX_V1.1",
        "CYCLONEDX_V1.0"
      ],
      "library": [
        "PYTHON"
      ],
      "supportedLanguages": [
        "C/C++"
      ],
      "_fromFile": "cyclonedx_for_conan2.json"
    },
    {
      "name": "CycloneDX for Erlang/Elixir (Mix)",
      "publisher": "Erlang Ecosystem Foundation",
      "description": "Mix task that generates CycloneDX SBOMs for Erlang/Elixir projects, exporting XML or JSON and supporting CycloneDX schema versions 1.3 through 1.7.",
      "repository_url": "https://github.com/erlef/mix_sbom",
      "website_url": "https://hex.pm/packages/sbom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT",
        "BOM_VERSION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "GITHUB_ACTION",
        "LIBRARY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3"
      ],
      "supportedLanguages": [
        "ERLANG_ELIXIR"
      ],
      "library": [
        "ERLANG_ELIXIR"
      ],
      "_fromFile": "cyclonedx_for_erlang_elixir_mix_.json"
    },
    {
      "name": "CycloneDX for Erlang/Elixir (Rebar3)",
      "publisher": "Erlang Ecosystem Foundation",
      "description": "Rebar3 plug-in that generates CycloneDX SBOMs for Erlang/Elixir projects, exporting XML or JSON and supporting CycloneDX v1.6.",
      "repository_url": "https://github.com/erlef/rebar3_sbom",
      "website_url": "https://hex.pm/packages/rebar3_sbom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT",
        "BOM_VERSION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "ERLANG_ELIXIR"
      ],
      "library": [
        "ERLANG_ELIXIR"
      ],
      "_fromFile": "cyclonedx_for_erlang_elixir_rebar3_.json"
    },
    {
      "name": "CycloneDX for esbuild",
      "publisher": "OWASP Foundation",
      "description": "CLI and plugin to generate CycloneDX SBOMs during esbuild and Bun builds.",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-esbuild",
      "website_url": "https://www.npmjs.com/package/@cyclonedx/cyclonedx-esbuild",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "ESBUILD_PLUGIN"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "supportedLanguages": [
        "JAVASCRIPT/TYPESCRIPT",
        "NODE.JS"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT",
        "NODE.JS"
      ],
      "_fromFile": "cyclonedx_for_esbuild.json"
    },
    {
      "name": "CycloneDX for Fortran Package Manager",
      "publisher": "Patrick Dwyer",
      "description": "Generates CycloneDX Software Bill of Materials (SBOM) for Fortran fpm projects.",
      "repository_url": "https://github.com/coderpatros/cyclonedx-fortran-fpm",
      "website_url": "https://github.com/coderpatros/cyclonedx-fortran-fpm",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [],
      "transform": [],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "FORTRAN"
      ],
      "_fromFile": "cyclonedx_for_fortran_fpm.json"
    },
    {
      "name": "CycloneDX for Go",
      "publisher": "Ozon",
      "description": "Command-line utility and Go library that generates CycloneDX SBOMs from Go module projects for supply-chain transparency.",
      "repository_url": "https://github.com/ozonru/cyclonedx-go",
      "website_url": "https://github.com/ozonru/cyclonedx-go",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "supportedLanguages": [
        "GO"
      ],
      "_fromFile": "cyclonedx_for_go.json"
    },
    {
      "name": "CycloneDX for Go modules",
      "publisher": "OWASP Foundation \u2013 CycloneDX Project",
      "description": "Command-line utility and Go library that generates CycloneDX SBOMs from Go modules, binaries and applications.",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-gomod",
      "website_url": "https://github.com/CycloneDX/cyclonedx-gomod",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT",
        "BOM_VERSION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "supportedLanguages": [
        "GO"
      ],
      "_fromFile": "cyclonedx_for_go_modules.json"
    },
    {
      "name": "CycloneDX for Gradle",
      "publisher": "CycloneDX",
      "description": "Gradle plugin that generates CycloneDX SBOMs (XML or JSON) for all dependencies in Java-based builds.",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-gradle-plugin",
      "website_url": "https://plugins.gradle.org/plugin/org.cyclonedx.bom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "LIBRARY"
      ],
      "library": [
        "JAVA"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "supportedLanguages": [
        "JAVA"
      ],
      "_fromFile": "cyclonedx_for_gradle.json"
    },
    {
      "name": "CycloneDX for Maven",
      "publisher": "OWASP Foundation / CycloneDX Project",
      "description": "Apache Maven plugin that automatically generates CycloneDX SBOMs (JSON or XML) for Java projects and can attach vulnerability disclosure information.",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-maven-plugin",
      "website_url": "https://github.com/CycloneDX/cyclonedx-maven-plugin",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT",
        "BOM_VERSION"
      ],
      "packaging": [
        "LIBRARY"
      ],
      "library": [
        "JAVA"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL",
        "CPE"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "supportedLanguages": [
        "JAVA"
      ],
      "_fromFile": "cyclonedx_for_maven.json"
    },
    {
      "name": "CycloneDX for .NET",
      "publisher": "CycloneDX",
      "description": "Generates CycloneDX Software Bill of Materials (SBOM) from .NET projects.",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-dotnet",
      "website_url": "https://www.nuget.org/packages/CycloneDX/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [],
      "transform": [],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7"
      ],
      "supportedLanguages": [
        ".NET"
      ],
      "_fromFile": "cyclonedx_for_net.json"
    },
    {
      "name": "CycloneDX for Node.js",
      "publisher": "OWASP Foundation (CycloneDX Project)",
      "description": "This is a so-called meta-package, it does not ship any own functionality, but it is a collection of optional dependencies with one purpose in common: generate CycloneDX Software-Bill-of-Materials (SBOM) from node-based projects.",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-node-module",
      "website_url": "https://www.npmjs.com/package/@cyclonedx/bom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "library": [
        "NODE.JS"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "supportedLanguages": [
        "JAVASCRIPT/TYPESCRIPT",
        "NODE.JS"
      ],
      "_fromFile": "cyclonedx_for_node_js.json"
    },
    {
      "name": "CycloneDX for NPM",
      "publisher": "CycloneDX",
      "description": "Create CycloneDX Software Bill of Materials (SBOM) from npm projects.",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-node-npm",
      "website_url": "https://www.npmjs.com/package/@cyclonedx/cyclonedx-npm",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT",
        "NODE.JS"
      ],
      "supportedLanguages": [
        "JAVASCRIPT/TYPESCRIPT",
        "NODE.JS"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "DESIGN",
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "_fromFile": "cyclonedx_for_npm.json"
    },
    {
      "name": "CycloneDX for PHP Composer",
      "publisher": "CycloneDX",
      "description": "Create CycloneDX Software Bill of Materials (SBOM) from PHP Composer projects.",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-php-composer",
      "website_url": "https://packagist.org/packages/cyclonedx/cyclonedx-php-composer",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "COMPOSER_PLUGIN",
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2",
        "CYCLONEDX_V1.1"
      ],
      "library": [
        "PHP"
      ],
      "supportedLanguages": [
        "PHP"
      ],
      "_fromFile": "cyclonedx_for_php_composer.json"
    },
    {
      "name": "CycloneDX for Python",
      "publisher": "CycloneDX",
      "description": "Generates CycloneDX SBOMs from Python (virtual) environments, requirement files, and manifests (Poetry, PipEnv, etc)",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-python",
      "website_url": "https://pypi.org/project/cyclonedx-bom/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2",
        "CYCLONEDX_V1.1",
        "CYCLONEDX_V1.0"
      ],
      "library": [
        "PYTHON"
      ],
      "supportedLanguages": [
        "PYTHON"
      ],
      "_fromFile": "cyclonedx_for_python.json"
    },
    {
      "name": "CycloneDX for Ruby Gems",
      "publisher": "OWASP Foundation",
      "description": "Command-line utility and Ruby library that generates CycloneDX SBOMs for Ruby projects by analysing Gem dependencies.",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-ruby-gem",
      "website_url": "https://rubygems.org/gems/cyclonedx-ruby",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "library": [
        "RUBY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.2"
      ],
      "supportedLanguages": [
        "RUBY"
      ],
      "_fromFile": "cyclonedx_for_ruby_gems.json"
    },
    {
      "name": "CycloneDX for Rust Cargo",
      "publisher": "CycloneDX Project (OWASP)",
      "description": "Cargo sub-command and CLI library that generates CycloneDX SBOMs for Rust projects, aggregating all crate dependencies and outputting JSON or XML.",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-rust-cargo",
      "website_url": "https://crates.io/crates/cyclonedx-bom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT",
        "BOM_VERSION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "library": [
        "RUST"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3"
      ],
      "supportedLanguages": [
        "RUST"
      ],
      "_fromFile": "cyclonedx_for_rust_cargo.json"
    },
    {
      "name": "CycloneDX for SBT (Scala)",
      "publisher": "Fabrizio Di Giuseppe",
      "description": "SBT plugin that generates CycloneDX SBOMs (JSON or XML) for Scala/Java builds, supporting schema v1.6 and integrating smoothly with Dependency-Track.",
      "repository_url": "https://github.com/sbt/sbt-sbom",
      "website_url": "https://github.com/sbt/sbt-sbom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT",
        "BOM_VERSION"
      ],
      "packaging": [
        "LIBRARY"
      ],
      "library": [
        "SCALA"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "JAVA",
        "SCALA"
      ],
      "_fromFile": "cyclonedx_for_sbt_scala_.json"
    },
    {
      "name": "CycloneDX for Webpack",
      "publisher": "OWASP Foundation",
      "description": "Webpack plugin that generates CycloneDX Software Bill of Materials (SBOM) for JavaScript/TypeScript bundles during the build process.",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-webpack-plugin",
      "website_url": "https://www.npmjs.com/package/@cyclonedx/webpack-plugin",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "WEBPACK_PLUGIN"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "supportedLanguages": [
        "JAVASCRIPT/TYPESCRIPT",
        "NODE.JS"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT",
        "NODE.JS"
      ],
      "_fromFile": "cyclonedx_for_webpack.json"
    },
    {
      "name": "CycloneDX for Yarn",
      "publisher": "CycloneDX",
      "description": "Create CycloneDX Software Bill of Materials (SBOM) from yarn projects.",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-node-yarn",
      "website_url": "https://classic.yarnpkg.com/en/package/@cyclonedx/yarn-plugin-cyclonedx",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "YARN_PLUGIN",
        "COMMAND_LINE_UTILITY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT",
        "NODE.JS"
      ],
      "supportedLanguages": [
        "NODE.JS",
        "JAVASCRIPT/TYPESCRIPT"
      ],
      "_fromFile": "cyclonedx_for_yarn.json"
    },
    {
      "name": "CycloneDX GoMod Generate SBOM",
      "publisher": "CycloneDX",
      "description": "GitHub action which generates CycloneDX SBOMs from Go modules, providing integration into CI/CD workflows for Go projects.",
      "repository_url": "https://github.com/CycloneDX/gh-gomod-generate-sbom",
      "website_url": "https://github.com/marketplace/actions/cyclonedx-gomod-generate-sbom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "GITHUB_ACTION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "supportedLanguages": [
        "GO"
      ],
      "_fromFile": "cyclonedx_gomod_generate_sbom.json"
    },
    {
      "name": "CycloneDX JavaScript Library",
      "publisher": "CycloneDX",
      "description": "Core functionality of CycloneDX for JavaScript (Node.js or Web Browser) written in TypeScript.",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-javascript-library",
      "website_url": "https://www.npmjs.com/package/@cyclonedx/cyclonedx-library",
      "capabilities": [
        "SBOM",
        "SAASBOM",
        "OBOM",
        "MBOM",
        "HBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [],
      "packaging": [
        "LIBRARY"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT",
        "NODE.JS"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL",
        "SWID"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "supportedLanguages": [
        "JAVASCRIPT/TYPESCRIPT",
        "NODE.JS"
      ],
      "_fromFile": "cyclonedx_javascript_library.json"
    },
    {
      "name": "CycloneDX Libraries for .NET",
      "publisher": "CycloneDX",
      "description": ".NET libraries to consume and produce CycloneDX Software Bill of Materials (SBOM).",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-dotnet-library",
      "website_url": "https://www.nuget.org/profiles/CycloneDX",
      "capabilities": [
        "SBOM",
        "SAASBOM",
        "OBOM",
        "MBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT",
        "BOM_VERSION"
      ],
      "packaging": [
        "LIBRARY"
      ],
      "library": [
        ".NET"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "DESIGN",
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL",
        "SWID"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2",
        "CYCLONEDX_V1.1",
        "CYCLONEDX_V1.0"
      ],
      "supportedLanguages": [
        ".NET"
      ],
      "_fromFile": "cyclonedx_libraries_for_net.json"
    },
    {
      "name": "CycloneDX library for Go",
      "publisher": "CycloneDX",
      "description": "Go library that can parse, create and serialize CycloneDX Software Bill of Materials (SBOM) in JSON or XML.",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-go",
      "website_url": "https://github.com/CycloneDX/cyclonedx-go",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "TRANSFORM"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT",
        "BOM_VERSION"
      ],
      "packaging": [
        "LIBRARY"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "DESIGN",
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "supportedLanguages": [
        "GO"
      ],
      "_fromFile": "cyclonedx_library_for_go.json"
    },
    {
      "name": "cyclonedx-merge",
      "publisher": "fnxpt",
      "description": "Tool to merge CycloneDX files (JSON/XML) with support for normal, flat, and smart merge modes.",
      "repository_url": "https://github.com/fnxpt/cyclonedx-merge",
      "website_url": "https://github.com/fnxpt/cyclonedx-merge",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "TRANSFORM"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [],
      "_fromFile": "cyclonedx_merge.json"
    },
    {
      "name": "CycloneDX MSBuild Task",
      "publisher": "Patrick Dwyer",
      "description": "Generates CycloneDX Software Bill of Materials (SBOM) for .NET projects by integrating into the MSBuild process.",
      "repository_url": "https://github.com/coderpatros/cyclonedx-dotnet-msbuild",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [],
      "transform": [],
      "packaging": [],
      "library": [],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7"
      ],
      "supportedLanguages": [
        ".NET"
      ],
      "_fromFile": "cyclonedx_msbuild.json"
    },
    {
      "name": "CycloneDX .NET Generate SBOM",
      "publisher": "CycloneDX",
      "description": "GitHub Action to create a CycloneDX Software Bill-of-Materials (SBOM) for .NET projects supporting multiple project formats and recursive analysis",
      "repository_url": "https://github.com/CycloneDX/gh-dotnet-generate-sbom",
      "website_url": "https://github.com/marketplace/actions/cyclonedx-dotnet-generate-sbom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "GITHUB_ACTION"
      ],
      "library": [],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [
        ".NET"
      ],
      "_fromFile": "cyclonedx_net_generate_sbom.json"
    },
    {
      "name": "CycloneDX Node.js Generate SBOM",
      "publisher": "CycloneDX",
      "description": "GitHub Action to create a CycloneDX Software Bill-of-Materials (SBOM) for Node.js projects containing an aggregate of all project dependencies. (note: considered deprecated)",
      "repository_url": "https://github.com/CycloneDX/gh-node-module-generatebom",
      "website_url": "https://github.com/marketplace/actions/cyclonedx-node-js-generate-sbom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [],
      "packaging": [
        "GITHUB_ACTION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.3"
      ],
      "supportedLanguages": [
        "NODE.JS",
        "JAVASCRIPT/TYPESCRIPT"
      ],
      "_fromFile": "cyclonedx_node_js_generate_sbom.json"
    },
    {
      "name": "cyclonedx-npm-pipe",
      "publisher": "ShiftLeftCyber",
      "description": "Bitbucket Pipe that packages cdxgen in a Docker image to generate CycloneDX v1.6 SBOMs for Node.js/npm projects in CI pipelines.",
      "repository_url": "https://github.com/ccideas/cyclonedx-npm-pipe",
      "website_url": "https://shiftleftcyber.io",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [],
      "packaging": [
        "CONTAINER_IMAGE"
      ],
      "library": [
        "SHELL"
      ],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "NODE.JS"
      ],
      "_fromFile": "cyclonedx_npm_pipe.json"
    },
    {
      "name": "CycloneDX Perl Library",
      "publisher": "Giuseppe Di Terlizzi",
      "description": "Perl library for generating CycloneDX BOMs.",
      "repository_url": "https://github.com/giterlizzi/perl-SBOM-CycloneDX",
      "website_url": "https://metacpan.org/pod/SBOM::CycloneDX",
      "capabilities": [
        "AI/ML-BOM",
        "CBOM",
        "CDXA",
        "HBOM",
        "MBOM",
        "OBOM",
        "RELEASE_NOTES",
        "SAASBOM",
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [],
      "packaging": [
        "LIBRARY"
      ],
      "library": [
        "PERL"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "supportedLanguages": [
        "PERL"
      ],
      "_fromFile": "cyclonedx_perl_library.json"
    },
    {
      "name": "CycloneDX PHP Composer Generate SBOM",
      "publisher": "CycloneDX",
      "description": "GitHub Action to create a CycloneDX Software Bill-of-Materials (SBOM) for PHP Composer projects (note: considered deprecated)",
      "repository_url": "https://github.com/CycloneDX/gh-php-composer-generate-sbom",
      "website_url": "https://github.com/marketplace/actions/cyclonedx-php-composer-generate-sbom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [],
      "packaging": [
        "GITHUB_ACTION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "supportedLanguages": [
        "PHP"
      ],
      "_fromFile": "cyclonedx_php_composer_generate_sbom.json"
    },
    {
      "name": "CycloneDX PHP Library",
      "publisher": "CycloneDX",
      "description": "PHP library that supplies data-models, serializers, validators and utilities for creating, parsing and validating CycloneDX BOM documents in JSON and XML formats.",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-php-library",
      "website_url": "https://packagist.org/packages/cyclonedx/cyclonedx-library",
      "capabilities": [
        "SBOM",
        "HBOM",
        "OBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [],
      "packaging": [
        "LIBRARY"
      ],
      "library": [
        "PHP"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2",
        "CYCLONEDX_V1.1"
      ],
      "supportedLanguages": [
        "PHP"
      ],
      "_fromFile": "cyclonedx_php_library.json"
    },
    {
      "name": "CycloneDX Python Generate SBOM",
      "publisher": "CycloneDX",
      "description": "GitHub Action to create a CycloneDX Software Bill-of-Materials (SBOM) for Python projects from requirements files (note: considered deprecated)",
      "repository_url": "https://github.com/CycloneDX/gh-python-generate-sbom",
      "website_url": "https://github.com/marketplace/actions/cyclonedx-python-generate-sbom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [],
      "packaging": [
        "GITHUB_ACTION"
      ],
      "library": [],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "PYTHON"
      ],
      "_fromFile": "cyclonedx_python_generate_sbom.json"
    },
    {
      "name": "CycloneDX Python Library",
      "publisher": "CycloneDX",
      "description": "This Python package provides data models, validators and more, to help you create/render/read CycloneDX documents.",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-python-lib",
      "website_url": "https://pypi.org/project/cyclonedx-python-lib/",
      "capabilities": [
        "SBOM",
        "CBOM",
        "MBOM",
        "OBOM",
        "SAASBOM",
        "RELEASE_NOTES",
        "VDR/VEX",
        "CDXA",
        "HBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "TRANSFORM"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT",
        "BOM_VERSION"
      ],
      "packaging": [
        "LIBRARY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL",
        "SWID"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2",
        "CYCLONEDX_V1.1",
        "CYCLONEDX_V1.0"
      ],
      "supportedLanguages": [
        "PYTHON"
      ],
      "_fromFile": "cyclonedx_python_library.json"
    },
    {
      "name": "CycloneDX Rust",
      "publisher": "Mark Dodgson",
      "description": "Simple Rust library to encode and decode CycloneDX BOMs.",
      "repository_url": "https://github.com/doddi/cyclonedx-rust",
      "website_url": "https://github.com/doddi/cyclonedx-rust",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "TRANSFORM"
      ],
      "analysis": [],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "LIBRARY"
      ],
      "library": [
        "RUST"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.2"
      ],
      "supportedLanguages": [],
      "_fromFile": "cyclonedx_rust.json"
    },
    {
      "name": "cyclonedx-verify",
      "publisher": "Patrick Dwyer",
      "description": "Command-line tool that verifies file integrity against CycloneDX SBOM files in JSON format, including signature and hash verification.",
      "repository_url": "https://github.com/coderpatros/cyclonedx-verify",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS",
        "SIGNING/NOTARY"
      ],
      "analysis": [
        "POLICY_EVALUATION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2",
        "CYCLONEDX_V1.1",
        "CYCLONEDX_V1.0",
        "CYCLONEDX_V1.7"
      ],
      "website_url": "https://github.com/coderpatros/cyclonedx-verify",
      "_fromFile": "cyclonedx_verify.json"
    },
    {
      "name": "CycloneDX Web Tool",
      "publisher": "CycloneDX",
      "description": "Web-based tool for validating, viewing, and converting CycloneDX SBOMs. Supports XML/JSON, and conversion between CycloneDX and SPDX formats.",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-web-tool",
      "website_url": "https://cyclonedx.github.io/cyclonedx-web-tool/",
      "capabilities": [
        "SBOM",
        "OBOM",
        "MBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "TRANSFORM",
        "ANALYSIS"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT",
        "BOM_VERSION"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2",
        "CYCLONEDX_V1.1",
        "CYCLONEDX_V1.0"
      ],
      "supportedLanguages": [],
      "_fromFile": "cyclonedx_web_tool.json"
    },
    {
      "name": "DaggerBoard",
      "publisher": "NewYork-Presbyterian Hospital",
      "description": "Vulnerability-scanning application that ingests CycloneDX or SPDX SBOM files, analyses listed dependencies for known CVEs, and presents results through a web dashboard.",
      "repository_url": "https://github.com/nyph-infosec/daggerboard",
      "website_url": "https://github.com/nyph-infosec/daggerboard",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [],
      "packaging": [
        "APPLICATION",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "PYTHON",
        "JAVASCRIPT_TYPESCRIPT"
      ],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [],
      "_fromFile": "daggerboard.json"
    },
    {
      "name": "Debricked",
      "publisher": "OpenText",
      "description": "Debricked lets teams automatically find, fix and prevent open-source vulnerabilities, avoid non-compliant licences and pick healthier dependencies, with CycloneDX SBOM import/export, CLI and SaaS dashboards.",
      "repository_url": "https://github.com/debricked/cli",
      "website_url": "https://debricked.com/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "FREEMIUM"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "DESIGN",
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "PHP",
        "PYTHON",
        "RUBY"
      ],
      "_fromFile": "debricked.json"
    },
    {
      "name": "debsbom",
      "publisher": "Siemens",
      "description": "debsbom generates SBOMs for distributions based on Debian in the two standard formats SPDX and CycloneDX.",
      "repository_url": "https://github.com/siemens/debsbom",
      "website_url": "https://siemens.github.io/debsbom/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "DESIGN",
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "_fromFile": "debsbom.json"
    },
    {
      "name": "Defect Dojo",
      "publisher": "OWASP",
      "description": "Open source vulnerability management and automation platform that can import CycloneDX SBOMs and over 190 security tool reports for centralized vulnerability tracking and analysis.",
      "repository_url": "https://github.com/DefectDojo/django-DefectDojo",
      "website_url": "https://www.defectdojo.org/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING"
      ],
      "transform": [],
      "packaging": [
        "APPLICATION",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PERL",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SWIFT"
      ],
      "_fromFile": "defect_dojo.json"
    },
    {
      "name": "Dependency-Track",
      "publisher": "OWASP",
      "description": "An intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain by leveraging SBOMs",
      "repository_url": "https://github.com/DependencyTrack/dependency-track",
      "website_url": "https://dependencytrack.org/",
      "capabilities": [
        "HBOM",
        "OBOM",
        "SAASBOM",
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "AUTHOR",
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS",
        "POLICY_EVALUATION"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "CONTAINER_IMAGE",
        "APPLICATION"
      ],
      "library": [
        "JAVA"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL",
        "CPE",
        "SWID"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "PYTHON",
        "RUBY",
        "PHP",
        "RUST",
        "C/C++",
        ".NET",
        "PERL",
        "ERLANG_ELIXIR"
      ],
      "_fromFile": "dependency_track.json"
    },
    {
      "name": "Dependency-Track Jenkins Plugin",
      "publisher": "OWASP",
      "description": "Jenkins plugin that publishes CycloneDX Software Bill-of-Materials (SBOM) to the Dependency-Track platform for vulnerability analysis and policy evaluation",
      "repository_url": "https://github.com/jenkinsci/dependency-track-plugin",
      "website_url": "https://plugins.jenkins.io/dependency-track/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "POLICY_EVALUATION"
      ],
      "transform": [],
      "packaging": [
        "JENKINS_PLUGIN"
      ],
      "library": [
        "JAVA"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.2",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [],
      "_fromFile": "dependency_track_jenkins_plugin.json"
    },
    {
      "name": "Dependency-Track Maven Plugin",
      "publisher": "Paul McKeown",
      "description": "Maven plugin that integrates with a Dependency-Track server to submit SBOMs and optionally fail execution when vulnerable dependencies are found",
      "repository_url": "https://github.com/pmckeown/dependency-track-maven-plugin",
      "website_url": "https://github.com/pmckeown/dependency-track-maven-plugin#readme",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "POLICY_EVALUATION"
      ],
      "transform": [],
      "packaging": [
        "MAVEN_PLUGIN"
      ],
      "library": [
        "JAVA"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.2",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "JAVA"
      ],
      "_fromFile": "dependency_track_maven_plugin.json"
    },
    {
      "name": "depguard",
      "publisher": "Jorge Morais",
      "description": "MCP security server for AI coding agents. Generates CycloneDX 1.6 SBOMs with optional VEX, audits npm packages against npm and GitHub advisories, scans tarballs for supply-chain attacks, and acts as a pre-install guardian. Zero runtime dependencies.",
      "repository_url": "https://github.com/mopanc/depguard",
      "website_url": "https://depguard.dev",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT",
        "NODE.JS"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "JAVASCRIPT/TYPESCRIPT",
        "NODE.JS"
      ],
      "_fromFile": "depguard.json"
    },
    {
      "name": "depproof",
      "publisher": "itsnotbug, LLC",
      "description": "Self-hosted software composition analysis: dependency license and OSV vulnerability audit plus CycloneDX SBOM generation for Maven, Gradle and npm/pnpm/yarn, running inside your perimeter as a container or GitHub Action.",
      "repository_url": "https://github.com/depproof/depproof-action",
      "website_url": "https://depproof.com",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "FREEMIUM",
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "LICENSE_REPORTING",
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION"
      ],
      "packaging": [
        "GITHUB_ACTION",
        "CONTAINER_IMAGE",
        "COMMAND_LINE_UTILITY"
      ],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "NODE.JS"
      ],
      "_fromFile": "depproof.json"
    },
    {
      "name": "DevKit Dossier",
      "publisher": "DevKit Srl",
      "description": "Hosted record keeper for CRA evidence. Stores each release's CycloneDX or SPDX JSON SBOM unchanged with a SHA-256 hash, matches its components daily against OSV advisories, adds CISA KEV and EPSS data, and exports an evidence pack. Not a scanner.",
      "website_url": "https://devkit.dev",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.7"
      ],
      "_fromFile": "devkit_dossier.json"
    },
    {
      "name": "Distro2SBOM",
      "publisher": "Anthony Harrison",
      "description": "A command line tool which creates CycloneDX and SPDX SBOMs for an installed application or distribution (Debian, RPM, Windows and FreeBSD systems supported).",
      "repository_url": "https://github.com/anthonyharrison/distro2sbom",
      "website_url": "https://pypi.org/project/distro2sbom/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "TRANSFORM",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "transform": [
        "BOM_STANDARD"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "_fromFile": "distro2sbom.json"
    },
    {
      "name": "docker-sbom-cli-plugin",
      "publisher": "Docker",
      "description": "Docker CLI plugin that generates Software Bills of Materials (SBOMs) for container images using Syft as the underlying scanner, with CycloneDX output support.",
      "repository_url": "https://github.com/docker/sbom-cli-plugin",
      "website_url": "https://github.com/docker/sbom-cli-plugin",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "GO",
        "SHELL"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [],
      "_fromFile": "docker_sbom_cli_plugin.json"
    },
    {
      "name": "dtrack-audit",
      "publisher": "OZON",
      "description": "Command-line client for OWASP Dependency-Track that publishes SBOMs and displays vulnerability information from the command line, designed for CI/CD integration",
      "repository_url": "https://github.com/ozontech/dtrack-audit",
      "website_url": "https://github.com/ozontech/dtrack-audit",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.2",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [],
      "_fromFile": "dtrack_audit.json"
    },
    {
      "name": "DtrackAuditor",
      "publisher": "Thinksabin",
      "description": "Python CLI tool to upload CycloneDX SBOMs to Dependency-Track, analyze vulnerabilities, enforce policy, and fail CI builds based on thresholds.",
      "repository_url": "https://github.com/thinksabin/DTrackAuditor",
      "website_url": "https://github.com/thinksabin/DTrackAuditor",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION"
      ],
      "transform": [],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "PYTHON"
      ],
      "_fromFile": "dtrackauditor.json"
    },
    {
      "name": "Eclipse SW360 Antenna",
      "publisher": "Eclipse Foundation",
      "description": "Archived tool that scanned project artifacts, downloaded sources for dependencies, validated licenses, and generated license compliance documentation",
      "repository_url": "https://github.com/eclipse-archived/antenna",
      "website_url": "https://www.eclipse.org/sw360/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "LICENSE_REPORTING",
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "library": [
        "JAVA"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [],
      "cycloneDxVersion": [],
      "supportedLanguages": [
        "JAVA"
      ],
      "_fromFile": "eclipse_sw360_antenna.json"
    },
    {
      "name": "EMBA",
      "publisher": "EMBA Project",
      "description": "EMBA is an open-source firmware security analyzer that extracts firmware, performs static and dynamic analysis, builds CycloneDX SBOMs with VEX data, and generates detailed vulnerability reports.",
      "repository_url": "https://github.com/e-m-b-a/emba",
      "website_url": "https://www.securefirmware.de",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "SHELL",
        "PYTHON"
      ],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "POST-BUILD",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "_fromFile": "emba.json"
    },
    {
      "name": "Endor Labs",
      "publisher": "Endor Labs",
      "description": "Cloud-native platform that auto-creates CycloneDX SBOMs, generates VEX, and analyzes reachability so teams can securely select, integrate and maintain open-source software at scale.",
      "website_url": "https://endorlabs.com",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "SUBSCRIPTION",
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS",
        "POLICY_EVALUATION"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "APPLICATION",
        "GITHUB_ACTION",
        "GITLAB_CI_TEMPLATE"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY"
      ],
      "_fromFile": "endor_labs.json"
    },
    {
      "name": "Enso",
      "publisher": "Enso Security",
      "description": "Application Security Posture Management (ASPM) platform that inventories software assets, tracks AppSec tools and processes, and outputs CycloneDX and SPDX SBOMs with optional VEX ingest.",
      "website_url": "https://www.enso.security",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "DISCOVERY",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "_fromFile": "enso.json"
    },
    {
      "name": "Evo by Snyk",
      "publisher": "Snyk",
      "description": "Evo helps you generate an AI-BOM including models, datasets, agents, tools, and MCPs within your Python projects.",
      "repository_url": "",
      "website_url": "https://evo.ai.snyk.io",
      "availability": [
        "SUBSCRIPTION"
      ],
      "capabilities": [
        "AI/ML-BOM"
      ],
      "functions": [],
      "supportedLanguages": [
        "PYTHON"
      ],
      "lifecycle": [
        "PRE-BUILD"
      ],
      "_fromFile": "evo_by_snyk.json"
    },
    {
      "name": "EXPLIoT IoT Security Assessment Framework",
      "publisher": "EXPLIoT",
      "description": "EXPLIoT is an AGPLv3 Python framework and CLI for assessing and exploiting IoT devices; it offers 140+ plug-ins and can generate CycloneDX SBOMs from firmware filesystems.",
      "repository_url": "https://gitlab.com/expliot_framework/expliot",
      "website_url": "https://expliot.io/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [],
      "_fromFile": "expliot_iot_security_assessment_framework.json"
    },
    {
      "name": "FACT",
      "publisher": "aDolus Technology Inc.",
      "description": "The aDolus FACT platform is an advanced aggregation, analytics, and correlation engine that generates NTIA-compliant SBOMs (including CycloneDX) and provides continuous cybersecurity risk intelligence across the software supply chain.",
      "website_url": "https://adolus.com",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "lifecycle": [
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "SWID"
      ],
      "_fromFile": "fact.json"
    },
    {
      "name": "Firmpath",
      "publisher": "Firmpath",
      "description": "Vulnerability monitoring for embedded firmware: resolves a build's SBOM and chip-vendor SDK (ESP-IDF, Zephyr, nRF Connect, STM32Cube, Silicon Labs) into bundled libraries and checks them against vendor advisories, NVD, OSV and KEV. Exports VEX.",
      "website_url": "https://www.firmpath.dev/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "FREEMIUM",
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [],
      "packaging": [
        "APPLICATION"
      ],
      "library": [],
      "platform": [],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "CPE",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "C/C++"
      ],
      "_fromFile": "firmpath.json"
    },
    {
      "name": "Flawnter",
      "publisher": "CyberTest",
      "description": "Flawnter is a zero-trust static, dynamic and composition analysis platform that detects code flaws, vulnerabilities and license risks, and generates CycloneDX/SPDX SBOMs during every scan.",
      "website_url": "https://www.flawnter.com/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "FREEMIUM",
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY"
      ],
      "library": [],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [
        "C/C++",
        ".NET",
        "JAVA",
        "KOTLIN",
        "JAVASCRIPT/TYPESCRIPT",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "GO",
        "RUBY",
        "RUST",
        "SWIFT"
      ],
      "_fromFile": "flawnter.json"
    },
    {
      "name": "Fortify on Demand",
      "publisher": "Micro Focus",
      "description": "SaaS application-security testing platform offering SAST, DAST and SCA. Produces and consumes CycloneDX SBOMs to secure the software supply chain across many languages, frameworks and package managers.",
      "repository_url": "https://github.com/fortify/github-action",
      "website_url": "https://www.microfocus.com/en-us/cyberres/application-security/fortify-on-demand",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "SUBSCRIPTION",
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "POLICY_EVALUATION"
      ],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY",
        "GITHUB_ACTION"
      ],
      "library": [
        "JAVA"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY",
        "SCALA",
        "KOTLIN",
        "SWIFT"
      ],
      "_fromFile": "fortify_on_demand.json"
    },
    {
      "name": "Fortify Software Security Center",
      "publisher": "Micro Focus",
      "description": "Open-source CycloneDX parser plugin for Fortify SSC that imports SBOMs, correlates components with known vulnerabilities and licenses, and displays them in the SSC portal.",
      "repository_url": "https://github.com/fortify/fortify-ssc-parser-generic-cyclonedx",
      "website_url": "https://github.com/fortify/fortify-ssc-parser-generic-cyclonedx",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "TRANSFORM",
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "LIBRARY"
      ],
      "library": [
        "JAVA"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL",
        "CPE",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY"
      ],
      "_fromFile": "fortify_software_security_center.json"
    },
    {
      "name": "Fortress Asset 2 Vendor",
      "publisher": "Fortress Information Security",
      "description": "Comprehensive cyber supply chain risk management platform that ingests, analyzes and securely shares SBOMs, HBOMs and other supply chain attestations via SaaS and permissioned blockchain.",
      "website_url": "https://assettovendor.com/",
      "repository_url": "https://assettovendor.com",
      "capabilities": [
        "SBOM",
        "HBOM",
        "VDR/VEX"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "DISTRIBUTE",
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING"
      ],
      "transform": [],
      "packaging": [
        "APPLICATION"
      ],
      "library": [],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [],
      "_fromFile": "fortress_asset_2_vendor.json"
    },
    {
      "name": "Fortress File Integrity Assurance",
      "publisher": "Fortress Information Security",
      "description": "A proprietary software analysis tool that validates patches and ensures software file integrity to enhance software supply chain security in critical infrastructure environments.",
      "website_url": "https://www.fortressinfosec.com/",
      "repository_url": "https://www.fortressinfosec.com/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION"
      ],
      "transform": [],
      "packaging": [
        "APPLICATION"
      ],
      "library": [],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [],
      "_fromFile": "fortress_file_integrity_assurance.json"
    },
    {
      "name": "FOSSA",
      "publisher": "FOSSA",
      "description": "Subscription SCA platform and CLI that generate, import, analyse, and distribute CycloneDX or SPDX SBOMs for licence and vulnerability risk management across CI/CD pipelines.",
      "repository_url": "https://github.com/fossas/fossa-cli",
      "website_url": "https://fossa.com",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "POLICY_EVALUATION"
      ],
      "transform": [
        "BOM_STANDARD"
      ],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [],
      "_fromFile": "fossa.json"
    },
    {
      "name": "FractalAI CBOM Seal",
      "publisher": "FRACTAL AI S.A.S.",
      "description": "Notarizes a CycloneDX CBOM: signs it with ML-DSA-65 (FIPS 204) and timestamps it against drand, so integrity, authorship and prior existence verify offline. Seals the inventory you declare; it does not audit or certify it.",
      "website_url": "https://fractalai.net.co/cbom",
      "capabilities": [
        "CBOM"
      ],
      "availability": [
        "FREEMIUM"
      ],
      "functions": [
        "SIGNING/NOTARY"
      ],
      "lifecycle": [
        "OPERATIONS"
      ],
      "_fromFile": "fractalai_cbom_seal.json"
    },
    {
      "name": "FuseSoC",
      "description": "Package manager and build tool for FPGA and HDL projects, including SPDX SBOM generation from IP metadata.",
      "publisher": "Olof Kindgren",
      "repository_url": "https://github.com/olofk/fusesoc",
      "website_url": "https://fusesoc.net",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "supportedStandards": [
        "PACKAGE_URL",
        "SPDX"
      ],
      "_fromFile": "fusesoc.json"
    },
    {
      "name": "Gemnasium",
      "publisher": "GitLab",
      "description": "Dependency scanning analyzer that uses the GitLab Advisory Database to detect vulnerabilities in project dependencies and generates CycloneDX SBOMs.",
      "repository_url": "https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium",
      "website_url": "https://docs.gitlab.com/ee/user/application_security/dependency_scanning/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "COMMERCIAL_LICENSE",
        "FREEMIUM"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING"
      ],
      "transform": [],
      "packaging": [
        "CONTAINER_IMAGE",
        "GITLAB_CI_TEMPLATE"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "RUBY",
        "PYTHON",
        "JAVASCRIPT/TYPESCRIPT",
        "NODE.JS",
        "JAVA",
        "GO",
        "PHP"
      ],
      "_fromFile": "gemnasium.json"
    },
    {
      "name": "genealogos",
      "publisher": "Tweag I/O",
      "description": "CLI and library to generate SBOMs from Nix expression without having to build the derivations, build on top of Nixtract.",
      "repository_url": "https://github.com/tweag/genealogos",
      "website_url": "https://github.com/tweag/genealogos",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "library": [
        "RUST"
      ],
      "platform": [
        "LINUX",
        "MAC"
      ],
      "lifecycle": [
        "PRE-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.4"
      ],
      "_fromFile": "genealogos.json"
    },
    {
      "name": "Generate SBoM for Elixir project",
      "publisher": "Red Shirts",
      "description": "GitHub Action to generate CycloneDX Software Bill-of-Materials (SBOM) for Erlang/Elixir Mix projects",
      "repository_url": "https://github.com/red-shirts/action-mix-sbom",
      "website_url": "https://github.com/marketplace/actions/generate-sbom-for-elixir-project",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [],
      "transform": [],
      "packaging": [
        "GITHUB_ACTION",
        "CONTAINER_IMAGE"
      ],
      "library": [],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.2"
      ],
      "supportedLanguages": [
        "ERLANG_ELIXIR"
      ],
      "_fromFile": "generate_sbom_for_elixir_project.json"
    },
    {
      "name": "gh-sbom",
      "publisher": "GitHub",
      "description": "CLI extension for the gh tool that generates CycloneDX or SPDX JSON SBOMs for any GitHub repository using Dependency Graph data.",
      "repository_url": "https://github.com/advanced-security/gh-sbom",
      "website_url": "https://github.com/advanced-security/gh-sbom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST"
      ],
      "_fromFile": "gh_sbom.json"
    },
    {
      "name": "GLaaS",
      "publisher": "TReqs Inc.",
      "description": "GLaaS (Global Lineage-as-a-Service) pairs with the open-source `roar` CLI to trace ML pipeline lineage and generate CycloneDX 1.7 AI-BOMs, scored for completeness against G7, CISA, and NTIA SBOM-for-AI minimum elements.",
      "repository_url": "https://github.com/treqs/roar",
      "website_url": "https://glaas.ai",
      "capabilities": [
        "AI/ML-BOM"
      ],
      "availability": [
        "FREEMIUM",
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE"
      ],
      "analysis": [
        "LICENSE_REPORTING",
        "POLICY_EVALUATION",
        "RESOURCE_REPORTING"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "APPLICATION"
      ],
      "library": [
        "PYTHON",
        "RUST"
      ],
      "platform": [
        "LINUX",
        "MAC"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7"
      ],
      "_fromFile": "glaas.json"
    },
    {
      "name": "Go Sonatypes",
      "publisher": "Sonatype",
      "description": "Common utility packages for working with OSS Index, Nexus IQ Server, CycloneDX SBOMs or getting a user-agent",
      "repository_url": "https://github.com/sonatype-nexus-community/go-sona-types",
      "website_url": "https://github.com/sonatype-nexus-community/go-sona-types",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION"
      ],
      "transform": [],
      "packaging": [
        "LIBRARY"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [
        "GO"
      ],
      "_fromFile": "go_sonatypes.json"
    },
    {
      "name": "gobom",
      "publisher": "Mattermost",
      "description": "An extensible CycloneDX BOM generator and Dependency-Track API client written in Go; supports Go, npm, CocoaPods and Gradle projects and uploads SBOMs for analysis.",
      "repository_url": "https://github.com/mattermost/gobom",
      "website_url": "https://github.com/mattermost/gobom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "DISTRIBUTE",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "supportedLanguages": [
        "GO",
        "JAVASCRIPT/TYPESCRIPT",
        "JAVA",
        "SWIFT"
      ],
      "_fromFile": "gobom.json"
    },
    {
      "name": "Grype",
      "publisher": "Anchore",
      "description": "A vulnerability scanner for container images and filesystems. Works with Syft SBOMs and supports CycloneDX, SPDX, and OpenVEX.",
      "repository_url": "https://github.com/anchore/grype",
      "website_url": "https://github.com/anchore/grype",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC"
      ],
      "lifecycle": [
        "DISCOVERY",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL",
        "CPE"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST"
      ],
      "_fromFile": "grype.json"
    },
    {
      "name": "Heimdall",
      "publisher": "MedCrypt",
      "description": "Automatically extract or manually upload your Software Bill of Materials (SBOM), and Heimdall will, on a continual basis, identify known vulnerabilities affecting your software components",
      "website_url": "https://www.medcrypt.com/solutions/helm",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "COMMERCIAL_LICENSE",
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "RESOURCE_REPORTING"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "_fromFile": "heimdall.json"
    },
    {
      "name": "Hermeto",
      "publisher": "The Hermeto Project",
      "description": "Hermeto is a CLI tool that pre-fetches your project's dependencies, which enables network-isolated builds, which enables the production of high-accuracy SBOMs",
      "repository_url": "https://github.com/hermetoproject/hermeto",
      "website_url": "https://hermetoproject.github.io/hermeto/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "transform": [],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [],
      "platform": [
        "LINUX",
        "MAC"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "SLSA",
        "PACKAGE_URL"
      ],
      "supportedLanguages": [
        "RUBY",
        "RUST",
        "GO",
        "JAVASCRIPT/TYPESCRIPT",
        "PYTHON"
      ],
      "_fromFile": "hermeto.json"
    },
    {
      "name": "Ion Channel Platform",
      "publisher": "Ion Channel",
      "description": "Risk management platform that enables analysis, exchange and continuous monitoring of Software Bills of Materials (SBOMs) to actively manage third party risk and compliance",
      "website_url": "https://www.exiger.com/products/ion-channel/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "_fromFile": "ion_channel_platform.json"
    },
    {
      "name": "ittosai",
      "publisher": "DevOps KungFu Masters",
      "description": "ittosai is a CycloneDX SBOM vulnerability analyzer that analyzes SBOMs every time a developer commits code to a repository.",
      "repository_url": "https://github.com/devops-kung-fu/ittosai",
      "website_url": "https://dkfm.io/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "_fromFile": "ittosai.json"
    },
    {
      "name": "Jake",
      "publisher": "Sonatype",
      "description": "An OSS Index integration to check your Conda environments for vulnerable Open Source packages",
      "repository_url": "https://github.com/sonatype-nexus-community/jake",
      "website_url": "https://jake.readthedocs.io/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION"
      ],
      "transform": [],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "PYTHON"
      ],
      "_fromFile": "jake.json"
    },
    {
      "name": "jbom",
      "publisher": "Eclipse Foundation (originally Contrast Security)",
      "description": "jbom generates runtime and static CycloneDX SBOMs for local or remote Java applications and archives.",
      "repository_url": "https://github.com/eclipse/jbom",
      "website_url": "https://projects.eclipse.org/projects/technology.jbom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "JAVA"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [
        "JAVA"
      ],
      "_fromFile": "jbom.json"
    },
    {
      "name": "JDisc Discovery",
      "publisher": "JDisc",
      "description": "Network discovery and IT inventory tool that can discover CycloneDX SBOMs on enterprise assets and ingest component inventory into the platform.",
      "website_url": "https://www.jdisc.com/",
      "repository_url": "https://www.jdisc.com/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "RESOURCE_REPORTING"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "DISCOVERY",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [],
      "_fromFile": "jdisc_discovery.json"
    },
    {
      "name": "Jetstack Secure",
      "publisher": "Jetstack",
      "description": "Manages machine identities across Cloud Native Kubernetes and OpenShift environments, providing a detailed view of enterprise security posture for TLS certificates and PKI.",
      "repository_url": "https://github.com/jetstack/jetstack-secure",
      "website_url": "https://www.jetstack.io/jetstack-secure/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION"
      ],
      "transform": [],
      "packaging": [
        "CONTAINER_IMAGE",
        "APPLICATION"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [],
      "_fromFile": "jetstack_secure.json"
    },
    {
      "name": "JSF CLI",
      "publisher": "Patrick Dwyer",
      "description": "CLI tool JSON Signature Format for SBOM signing, and signature verification.",
      "repository_url": "https://github.com/coderpatros/dotnet-jsf",
      "website_url": "https://github.com/coderpatros/dotnet-jsf",
      "capabilities": [
        "SBOM",
        "SAASBOM",
        "OBOM",
        "MBOM",
        "AI/ML-BOM",
        "CBOM",
        "CDXA",
        "HBOM",
        "RELEASE_NOTES",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "SIGNING/NOTARY"
      ],
      "analysis": [],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        ".NET"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2",
        "CYCLONEDX_V1.1",
        "CYCLONEDX_V1.0"
      ],
      "supportedLanguages": [],
      "_fromFile": "jsf_cli.json"
    },
    {
      "name": "JSF Web Tool",
      "publisher": "Patrick Dwyer",
      "description": "JSON Signature Format web tool for SBOM signing, and signature verification.",
      "repository_url": "https://github.com/coderpatros/dotnet-jsf",
      "website_url": "https://patrickdwyer.au/dotnet-jsf/",
      "capabilities": [
        "SBOM",
        "SAASBOM",
        "OBOM",
        "MBOM",
        "AI/ML-BOM",
        "CBOM",
        "CDXA",
        "HBOM",
        "RELEASE_NOTES",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "SIGNING/NOTARY"
      ],
      "analysis": [],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2",
        "CYCLONEDX_V1.1",
        "CYCLONEDX_V1.0"
      ],
      "supportedLanguages": [],
      "_fromFile": "jsf_web.json"
    },
    {
      "name": "JupiterOne",
      "publisher": "JupiterOne",
      "description": "Easily identify, map, analyze, and secure cyber assets and attack surface. Gain full visibility into complex cloud environments to uncover threats, close compliance gaps, and prioritize risk.",
      "website_url": "https://jupiterone.com/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "RESOURCE_REPORTING",
        "LICENSE_REPORTING"
      ],
      "transform": [],
      "packaging": [
        "APPLICATION"
      ],
      "library": [],
      "platform": [
        "WINDOWS",
        "MAC",
        "LINUX"
      ],
      "lifecycle": [
        "DISCOVERY",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [],
      "_fromFile": "jupiterone.json"
    },
    {
      "name": "kbom - Kubernetes Bill of Materials powered by KSOC",
      "publisher": "KSOC",
      "description": "kbom is an open-source CLI tool from KSOC, written in Go, that generates detailed CycloneDX SBOMs for Kubernetes clusters, including nodes, control plane, OS, and cloud infrastructure details.",
      "repository_url": "https://github.com/rad-security/kbom",
      "website_url": "https://github.com/rad-security/kbom",
      "capabilities": [
        "SBOM",
        "OBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "RESOURCE_REPORTING"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "_fromFile": "kbom_kubernetes_bill_of_materials_powered_by_ksoc.json"
    },
    {
      "name": "KernelScan Dependency-Track Plugin",
      "publisher": "KernelScan",
      "description": "Config-aware Linux-kernel CVE analyzer plugin for Dependency-Track v5. Reports only the CVEs reachable in a kernel's running .config, and delivers config-aware not_affected/exploitable verdicts as CycloneDX VEX.",
      "repository_url": "https://github.com/kernelscan/kernelscan-dt-plugin",
      "website_url": "https://kernelscan.io/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "library": [
        "JAVA"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "OPERATIONS",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "CPE",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "C/C++"
      ],
      "_fromFile": "kernelscan_dt_plugin.json"
    },
    {
      "name": "Keysight IoT Security Assessment",
      "publisher": "Keysight",
      "description": "Automated firmware analysis platform that generates SBOMs and identifies vulnerabilities, misconfigurations, hardcoded credentials, weak cryptography, and potential zero-day vulnerabilities in IoT devices.",
      "website_url": "https://www.keysight.com/be/en/products/network-security/iot-security-assessment.html",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION"
      ],
      "transform": [],
      "packaging": [
        "APPLICATION"
      ],
      "library": [],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "DISCOVERY",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [],
      "_fromFile": "keysight_iot_security_assessment.json"
    },
    {
      "name": "KICS",
      "publisher": "Checkmarx",
      "description": "KICS scans Infrastructure-as-Code to detect security vulnerabilities, compliance issues and misconfigurations, exporting results as CycloneDX SBOM and VDR reports.",
      "repository_url": "https://github.com/Checkmarx/kics",
      "website_url": "https://www.kics.io/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION",
        "AZURE_PIPELINE_EXTENSION"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.3"
      ],
      "_fromFile": "kics.json"
    },
    {
      "name": "Ko",
      "publisher": "Ko Build",
      "description": "Simple, fast container image builder for Go applications that generates CycloneDX SBOMs by default, supports multi-platform builds, and integrates seamlessly with Kubernetes.",
      "repository_url": "https://github.com/ko-build/ko",
      "website_url": "https://ko.build/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [],
      "transform": [],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "GO"
      ],
      "_fromFile": "ko.json"
    },
    {
      "name": "Kondukto",
      "publisher": "Kondukto",
      "description": "Application Security Orchestration and Correlation platform that generates and consumes CycloneDX or SPDX SBOMs, correlates vulnerability scanner findings, and automates remediation workflows across CI/CD pipelines.",
      "website_url": "https://kondukto.io",
      "repository_url": "https://github.com/kondukto-io/kdt",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [
        "BOM_STANDARD"
      ],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [],
      "_fromFile": "kondukto.json"
    },
    {
      "name": "KubeClarity",
      "publisher": "Cisco",
      "description": "Open-source platform (CLI, UI & Helm chart) that generates SBOMs, converts them between CycloneDX/SPDX formats, and scans container images, directories and running Kubernetes clusters for vulnerabilities, licences and CIS Docker benchmark findings.",
      "repository_url": "https://github.com/openclarity/kubeclarity",
      "website_url": "https://github.com/cisco-open/kubei",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "APPLICATION"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PERL",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SWIFT"
      ],
      "_fromFile": "kubeclarity.json"
    },
    {
      "name": "Kyverno",
      "publisher": "Kyverno Project (CNCF Incubating)",
      "description": "Kyverno is an open-source Kubernetes policy engine that validates, mutates and generates configurations, and can evaluate CycloneDX SBOM attestations to enforce supply-chain policies.",
      "repository_url": "https://github.com/kyverno/kyverno",
      "website_url": "https://kyverno.io",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "POLICY_EVALUATION",
        "SECURITY_VULNERABILITIES"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "_fromFile": "kyverno.json"
    },
    {
      "name": "Lagoon Insights Handler",
      "publisher": "Lagoon",
      "description": "Component that processes CycloneDX SBOMs and container image metadata for Lagoon environments, with vulnerability analysis via Trivy integration and customizable data filtering.",
      "repository_url": "https://github.com/uselagoon/insights-handler",
      "website_url": "https://lagoon.sh/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "CONTAINER_IMAGE",
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.3"
      ],
      "supportedLanguages": [
        "GO"
      ],
      "_fromFile": "lagoon_insights_handler.json"
    },
    {
      "name": "LegacyMind",
      "publisher": "LegacyMind GmbH",
      "description": "Binary firmware analysis without source code: CycloneDX SBOM from Linux images and bare-metal builds (ELF/AXF from Keil, IAR, GNU Arm), supplier SBOM import (CycloneDX, SPDX), and CVE matching incl. known-exploited vulnerabilities.",
      "website_url": "https://www.legacymind.de/en/formats",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL",
        "CPE"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "_fromFile": "legacymind.json"
    },
    {
      "name": "Lib4sbom",
      "publisher": "Anthony Harrison",
      "description": "Python library that parses, validates, converts and generates xBOMs in CycloneDX and SPDX formats, allowing JSON, Tag, YAML and XML serialization and programmatic manipulation of packages, files and dependencies.",
      "repository_url": "https://github.com/anthonyharrison/lib4sbom",
      "website_url": "https://pypi.org/project/lib4sbom/",
      "capabilities": [
        "AI/ML-BOM",
        "OBOM",
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "TRANSFORM"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "LIBRARY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "_fromFile": "lib4sbom.json"
    },
    {
      "name": "License Scanner",
      "publisher": "CycloneDX",
      "description": "license-scanner is an Apache-2.0 Go library and CLI that detects SPDX-style licenses and legal terms in source files and outputs CycloneDX v1.4 SBOMs with detailed license data.",
      "repository_url": "https://github.com/CycloneDX/license-scanner",
      "website_url": "https://github.com/CycloneDX/license-scanner",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "transform": [],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [],
      "_fromFile": "license_scanner.json"
    },
    {
      "name": "LicenseComplianceTool",
      "publisher": "medavis GmbH",
      "description": "Creates license manifests from CycloneDX SBOMs. Provides a Jenkins build step and CLI to list third-party components, their licenses, and download license texts to aid open-source compliance.",
      "repository_url": "https://github.com/medavis-gmbh/LicenseComplianceTool",
      "website_url": "https://github.com/medavis-gmbh/LicenseComplianceTool",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "JENKINS_PLUGIN",
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "JAVA"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "supportedLanguages": [
        "JAVA",
        "NODE.JS",
        "JAVASCRIPT/TYPESCRIPT"
      ],
      "_fromFile": "licensecompliancetool.json"
    },
    {
      "name": "Lucent Sky AVM",
      "publisher": "Lucent Sky",
      "description": "Scans binaries, source code, dependencies, and existing SBOMs to identify and remediate known and unknown vulnerabilities. Generates CycloneDX and SPDX SBOMs to support compliance and supply chain transparency.",
      "website_url": "https://www.lucentsky.com/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "SUBSCRIPTION",
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "POLICY_EVALUATION",
        "OUTDATED_COMPONENTS"
      ],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL",
        "CPE"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        ".NET",
        "C/C++",
        "GO",
        "GROOVY",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "KOTLIN",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SCALA",
        "SWIFT"
      ],
      "_fromFile": "lucent_sky_avm.json"
    },
    {
      "name": "lynkctl",
      "publisher": "Interlynk.io",
      "description": "Command-line utility that generates CycloneDX SBOMs from C/C++ and embedded firmware build systems (GNU Make, CMake, IAR) and package manager manifests (npm, Cargo, Go, Maven, Gradle, NuGet, Python, RubyGems, PHP, Gleam) without executing the build.",
      "repository_url": "https://github.com/interlynk-io/lynkctl-public",
      "website_url": "https://www.interlynk.io/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.7"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST"
      ],
      "_fromFile": "lynkctl.json"
    },
    {
      "name": "macaron",
      "publisher": "Oracle",
      "description": "Macaron is a supply chain security analysis tool and policy engine that checks conformance to frameworks such as SLSA, integrating CycloneDX SBOM generators or consuming existing SBOMs for automated analysis of build integrity and dependencies.",
      "repository_url": "https://github.com/oracle/macaron",
      "website_url": "https://oracle.github.io/macaron/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "POLICY_EVALUATION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "PYTHON",
        "SHELL"
      ],
      "platform": [
        "LINUX",
        "MAC"
      ],
      "lifecycle": [
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "_fromFile": "macaron.json"
    },
    {
      "name": "Manifest",
      "publisher": "Manifest",
      "description": "Manifest is a subscription SBOM management platform that auto-generates, aggregates, enriches, analyzes, and securely shares CycloneDX or SPDX SBOMs via web app and GitHub Action integration.",
      "repository_url": "https://github.com/manifest-cyber/manifest-github-action",
      "website_url": "https://manifestcyber.com/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "packaging": [
        "APPLICATION",
        "GITHUB_ACTION"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "_fromFile": "manifest.json"
    },
    {
      "name": "mdbom",
      "publisher": "Robert Hansel",
      "description": "A simple command line tool to transform CycloneDX SBoMs to markdown.",
      "repository_url": "https://github.com/HaRo87/mdbom",
      "website_url": "https://haro87.github.io/mdbom/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "TRANSFORM"
      ],
      "analysis": [],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "PYTHON",
        "JAVASCRIPT/TYPESCRIPT",
        "GO"
      ],
      "_fromFile": "mdbom.json"
    },
    {
      "name": "MedScan",
      "publisher": "MedSec",
      "description": "Consumes SBOMs to help hospitals manage medical device assets, providing vulnerability and resource analysis for compliance and risk management.",
      "repository_url": "https://www.medsec.com/",
      "website_url": "https://www.medsec.com/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "RESOURCE_REPORTING"
      ],
      "transform": [],
      "packaging": [
        "APPLICATION"
      ],
      "library": [],
      "platform": [
        "LINUX",
        "WINDOWS"
      ],
      "lifecycle": [
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [],
      "_fromFile": "medscan.json"
    },
    {
      "name": "Mend SCA",
      "publisher": "Mend (Whitesource)",
      "description": "Mend SCA provides software composition analysis that scans direct and transitive open-source dependencies, enforces security and license policies, and exports CycloneDX or SPDX SBOMs with optional VEX data.",
      "repository_url": "https://github.com/mend-toolkit/Mend-SBOM-Export-CLI",
      "website_url": "https://www.mend.io/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION",
        "JENKINS_PLUGIN",
        "AZURE_PIPELINE_EXTENSION"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "PYTHON",
        "GO",
        ".NET",
        "NODE.JS",
        "PHP",
        "RUBY",
        "C/C++"
      ],
      "_fromFile": "mend_sca.json"
    },
    {
      "name": "meta-cyclonedx",
      "publisher": "iris-GmbH infrared & intelligent sensors",
      "description": "meta-cyclonedx is a Yocto meta-layer which produces CycloneDX SBOM and VEX files",
      "repository_url": "https://github.com/iris-GmbH/meta-cyclonedx",
      "website_url": "https://github.com/iris-GmbH/meta-cyclonedx",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "DISTRIBUTE",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "LICENSE_REPORTING",
        "SECURITY_VULNERABILITIES"
      ],
      "packaging": [
        "LIBRARY"
      ],
      "library": [
        "PYTHON",
        "SHELL"
      ],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "CPE",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.7"
      ],
      "_fromFile": "meta_cyclonedx.json"
    },
    {
      "name": "meta-dependencytrack",
      "publisher": "BG Networks",
      "description": "meta-dependencytrack is a Yocto meta-layer which produces a CycloneDX Software Bill of Materials (aka SBOM) from your root filesystem and then uploads it to a Dependency-Track server against the project of your choice",
      "repository_url": "https://github.com/bgnetworks/meta-dependencytrack",
      "website_url": "https://github.com/bgnetworks/meta-dependencytrack",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "DISTRIBUTE",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "packaging": [
        "LIBRARY"
      ],
      "library": [
        "PYTHON",
        "SHELL"
      ],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.6"
      ],
      "_fromFile": "meta_dependencytrack.json"
    },
    {
      "name": "Meta Package Manager",
      "publisher": "Kevin Deldycke",
      "description": "Export a SBOM of all packages installed on a Linux, macOS or Windows system.",
      "repository_url": "https://github.com/kdeldycke/meta-package-manager",
      "website_url": "https://kdeldycke.github.io/meta-package-manager/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OSI_APPROVED",
        "OPEN_SOURCE"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "library": [
        "PYTHON"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [
        ".NET",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "PYTHON"
      ],
      "_fromFile": "meta_package_manager.json"
    },
    {
      "name": "Meterian BOSS scanner",
      "publisher": "Meterian",
      "description": "Software composition analysis that inventories codebases and produces CycloneDX SBOMs while detecting security and licence risks across 12+ ecosystems.",
      "repository_url": "https://github.com/MeterianHQ/meterian-github-action",
      "website_url": "https://meterian.io/products/boss",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "FREEMIUM",
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "GITHUB_ACTION",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "SHELL"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL",
        "CPE"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PERL",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SWIFT"
      ],
      "_fromFile": "meterian_boss_scanner.json"
    },
    {
      "name": "MLBOMdoc",
      "publisher": "Anthony Harrison",
      "description": "A command line tool which produces a human-readable representation of a CycloneDX ML Bill of Materials (MLBOM). Output formats include PDF and Markdown.",
      "repository_url": "https://github.com/anthonyharrison/mlbomdoc",
      "website_url": "https://pypi.org/project/mlbomdoc/",
      "capabilities": [
        "AI/ML-BOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "TRANSFORM"
      ],
      "analysis": [],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "PYTHON"
      ],
      "_fromFile": "mlbomdoc.json"
    },
    {
      "name": "Nancy",
      "publisher": "Sonatype",
      "description": "A tool to check for vulnerabilities in your Golang dependencies, powered by Sonatype OSS Index",
      "repository_url": "https://github.com/sonatype-nexus-community/nancy",
      "website_url": "https://github.com/sonatype-nexus-community/nancy",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION"
      ],
      "transform": [],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [
        "GO"
      ],
      "_fromFile": "nancy.json"
    },
    {
      "name": "Neo4Cyclone",
      "publisher": "Javier Dominguez",
      "description": "Neo4Cyclone is a tool that allows you to visualise your SBOMs using Neo4J.",
      "repository_url": "https://github.com/javixeneize/neo4cyclone",
      "website_url": "https://github.com/javixeneize/neo4cyclone",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "PYTHON"
      ],
      "_fromFile": "neo4cyclone.json"
    },
    {
      "name": "NetRise Platform",
      "publisher": "NetRise",
      "description": "The NetRise Platform generates SBOMs for binary code and post-build artifacts. It can ingest and analyze 3rd party SBOMs and provide guidance on risk mitigation, including CVEs, hardcoded credentials, cryptographic risk, and misconfigured services.",
      "website_url": "https://www.netrise.io/",
      "repository_url": "https://github.com/netriseinc",
      "capabilities": [
        "SBOM",
        "CBOM",
        "VDR/VEX"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "RESOURCE_REPORTING",
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT",
        "BOM_STANDARD"
      ],
      "packaging": [
        "APPLICATION",
        "GITHUB_ACTION"
      ],
      "library": [],
      "platform": [
        "LINUX",
        "WINDOWS",
        "MAC"
      ],
      "lifecycle": [
        "DISCOVERY",
        "OPERATIONS",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "CPE",
        "PACKAGE_URL",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "supportedLanguages": [
        "C/C++",
        ".NET",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "NODE.JS",
        "PYTHON"
      ],
      "_fromFile": "netrise_platform.json"
    },
    {
      "name": "Nexus IQ",
      "publisher": "Sonatype",
      "description": "Software Composition Analysis (SCA) platform that can consume, analyze, and produce CycloneDX SBOMs",
      "website_url": "https://www.sonatype.com/product-nexus-lifecycle",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.3"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY",
        "SWIFT"
      ],
      "_fromFile": "nexus_iq.json"
    },
    {
      "name": "Nexus Lifecycle Jenkins Plugin",
      "publisher": "Sonatype",
      "description": "Publishes CycloneDX SBOMs to Nexus IQ for per-build analysis, result visualization, and policy evaluation",
      "repository_url": "https://github.com/jenkinsci/nexus-platform-plugin",
      "website_url": "https://help.sonatype.com/en/sonatype-platform-plugin-for-jenkins.html",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "DISTRIBUTE",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING"
      ],
      "transform": [],
      "packaging": [
        "JENKINS_PLUGIN"
      ],
      "library": [],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PERL",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SWIFT"
      ],
      "_fromFile": "nexus_lifecycle_jenkins_plugin.json"
    },
    {
      "name": "nim_lk",
      "publisher": "Emery Hemingway",
      "description": "Create and update SBOMs for the Nim programing language. Includes a translation module for the Nimble package manager as well as a Nix expression for building packages from SBOMs.",
      "repository_url": "https://git.sr.ht/~ehmry/nim_lk",
      "website_url": "https://git.sr.ht/~ehmry/nim_lk",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "NIM"
      ],
      "platform": [
        "LINUX"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "_fromFile": "nim_lk.json"
    },
    {
      "name": "Noma",
      "publisher": "Noma Security",
      "description": "AI Application Security Platform for the entire AI lifecycle, focusing on AI asset discovery, ML-BOM, and AI supply chain risk management.",
      "website_url": "https://noma.security",
      "capabilities": [
        "AI/ML-BOM"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION"
      ],
      "transform": [],
      "packaging": [
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "DESIGN",
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "JAVASCRIPT/TYPESCRIPT",
        "PYTHON",
        "JAVA",
        "C/C++",
        ".NET",
        "RUST",
        "GO"
      ],
      "_fromFile": "noma.json"
    },
    {
      "name": "NowSecure Platform",
      "publisher": "NowSecure",
      "description": "Mobile application security testing solution that automates static, dynamic and interactive testing, with SBOM capabilities through GitHub integrations",
      "website_url": "https://www.nowsecure.com/products/nowsecure-platform/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "OUTDATED_COMPONENTS"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "_fromFile": "nowsecure_platform.json"
    },
    {
      "name": "Ochrona CLI",
      "publisher": "Ochrona",
      "description": "A command line tool for detecting vulnerabilities in Python dependencies and doing safe package installs. Outputs CycloneDX SBOMs and supports policy enforcement.",
      "repository_url": "https://github.com/ochronasec/ochrona-cli",
      "website_url": "https://ochrona.dev/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.3"
      ],
      "supportedLanguages": [
        "PYTHON"
      ],
      "_fromFile": "ochrona_cli.json"
    },
    {
      "name": "Oligo Runtime SBOM",
      "publisher": "Oligo",
      "description": "Oligo Security delivers instant insights into actively executed libraries, assessing open source risks and confirming exploitability. It enables CycloneDX SBOM creation and auto-generates VEX.",
      "website_url": "https://www.oligo.security/",
      "repository_url": "https://www.oligo.security/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [
        ".NET",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "PYTHON"
      ],
      "_fromFile": "oligo_runtime_sbom.json"
    },
    {
      "name": "ONEKEY firmware analysis platform",
      "publisher": "ONEKEY",
      "description": "Cloud-based platform that automatically extracts firmware images, enumerates components, and produces CycloneDX SBOM and vulnerability reports.",
      "website_url": "https://onekey.com/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "SUBSCRIPTION",
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "OUTDATED_COMPONENTS",
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "lifecycle": [
        "POST-BUILD",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "_fromFile": "onekey_firmware_analysis_platform.json"
    },
    {
      "name": "OpenRewrite",
      "publisher": "OpenRewrite Project",
      "description": "Open-source automated refactoring ecosystem for code transformation, security remediation, and dependency management through reusable recipes and build tool plugins.",
      "repository_url": "https://github.com/openrewrite/rewrite",
      "website_url": "https://docs.openrewrite.org/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "TRANSFORM",
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "RESOURCE_REPORTING"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "LIBRARY",
        "COMMAND_LINE_UTILITY",
        "LIBRARY",
        "MAVEN_PLUGIN"
      ],
      "library": [
        "JAVA"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [
        "JAVA",
        "KOTLIN",
        "GROOVY",
        "JAVASCRIPT/TYPESCRIPT"
      ],
      "_fromFile": "openrewrite.json"
    },
    {
      "name": "OSS Inventory",
      "publisher": "Thiago Pinto",
      "description": "A web application for importing, storing, and visualizing CycloneDX SBOMs, allowing organizations to track software components across projects.",
      "repository_url": "https://github.com/thspinto/oss_inventory",
      "website_url": "https://github.com/thspinto/oss_inventory",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "RESOURCE_REPORTING"
      ],
      "transform": [],
      "packaging": [
        "APPLICATION"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [],
      "_fromFile": "oss_inventory.json"
    },
    {
      "name": "OSS Review Toolkit (ORT)",
      "publisher": "OSS Review Toolkit",
      "description": "A comprehensive suite of tools to automate software compliance checks, analyze dependencies / vulnerabilities, and generate reports.",
      "repository_url": "https://github.com/oss-review-toolkit/ort",
      "website_url": "https://oss-review-toolkit.org/",
      "capabilities": [
        "SBOM",
        "CBOM",
        "OBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "POLICY_EVALUATION"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT",
        "BOM_VERSION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "LIBRARY",
        "APPLICATION",
        "GITHUB_ACTION",
        "GITLAB_CI_TEMPLATE",
        "JENKINS_PLUGIN"
      ],
      "library": [
        "JAVA",
        "KOTLIN"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL",
        "CPE",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2",
        "CYCLONEDX_V1.1",
        "CYCLONEDX_V1.0"
      ],
      "supportedLanguages": [
        "C/C++",
        ".NET",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "KOTLIN",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SCALA",
        "SWIFT"
      ],
      "_fromFile": "oss_review_toolkit_ort_.json"
    },
    {
      "name": "OSV",
      "publisher": "Google",
      "description": "Open source vulnerability database and scanner that accepts CycloneDX SBOMs as input and identifies known vulnerabilities in components across multiple ecosystems.",
      "repository_url": "https://github.com/google/osv.dev",
      "website_url": "https://osv.dev/",
      "capabilities": [
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION"
      ],
      "library": [
        "PYTHON",
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "NODE.JS",
        "PYTHON",
        "RUBY",
        "RUST",
        ".NET"
      ],
      "_fromFile": "osv.json"
    },
    {
      "name": "Parlay",
      "publisher": "Snyk",
      "description": "Parlay is an Apache-licensed CLI written in Go that takes CycloneDX 1.4 JSON/XML or SPDX 2.3 SBOMs and enriches them with licence, vulnerability, maintainer and scorecard data from services like ecosyste.ms, Snyk and OpenSSF.",
      "repository_url": "https://github.com/snyk/parlay",
      "website_url": "https://github.com/snyk/parlay",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "_fromFile": "parlay.json"
    },
    {
      "name": "CycloneDX SBOM Parser for PHP",
      "publisher": "Martin Adler",
      "description": "Type-safe, read-only PHP library for parsing CycloneDX SBOM JSON files. Supports CycloneDX 1.4+ including components, vulnerabilities, and metadata. Built for application code that needs to consume existing SBOM files.",
      "repository_url": "https://github.com/mteu/sbom-parser",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "packaging": [
        "LIBRARY"
      ],
      "library": [
        "PHP"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.7"
      ],
      "_fromFile": "parser_php.json"
    },
    {
      "name": "pip-audit",
      "publisher": "Trail of Bits",
      "description": "Audits Python environments and dependency trees for known vulnerabilities and can emit CycloneDX SBOMs of affected components.",
      "repository_url": "https://github.com/pypa/pip-audit",
      "website_url": "https://github.com/pypa/pip-audit",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "GITHUB_ACTION",
        "LIBRARY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "PYTHON"
      ],
      "_fromFile": "pip_audit.json"
    },
    {
      "name": "pnpm",
      "publisher": "pnpm",
      "description": "Fast, disk space efficient JavaScript package manager with a CLI command to generate SBOMs in CycloneDX and SPDX formats.",
      "repository_url": "https://github.com/pnpm/pnpm",
      "website_url": "https://pnpm.io/cli/sbom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "PRE-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.7"
      ],
      "supportedLanguages": [
        "JAVASCRIPT/TYPESCRIPT",
        "NODE.JS"
      ],
      "_fromFile": "pnpm.json"
    },
    {
      "name": "Prisma Cloud",
      "publisher": "Palo Alto Networks",
      "description": "Unified cloud-native application protection platform that scans code, pipelines, infrastructure and runtime to generate CycloneDX SBOMs, analyze vulnerabilities, licenses and misconfigurations, and secure entitlements across multi-cloud environments.",
      "website_url": "https://www.paloaltonetworks.com/prisma/cloud",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "SUBSCRIPTION",
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY",
        "JENKINS_PLUGIN"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY"
      ],
      "_fromFile": "prisma_cloud.json"
    },
    {
      "name": "ProCap360",
      "publisher": "Internet Infrastructure Services Corp.",
      "description": "An advanced SBOM, RBOM and AIBOM  cybersecurity risk management tool using novel knowledge graph technology to enhance software supply chain security and visually display real time application assurance.",
      "repository_url": "https://github.com/ProCap360",
      "website_url": "https://procap360.com",
      "capabilities": [
        "SBOM",
        "SAASBOM",
        "CBOM",
        "HBOM",
        "OBOM",
        "AI/ML-BOM",
        "VDR/VEX",
        "CDXA",
        "RELEASE_NOTES"
      ],
      "availability": [
        "COMMERCIAL_LICENSE",
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE",
        "PACKAGE_MANAGER_INTEGRATION",
        "SIGNING/NOTARY",
        "TRANSFORM"
      ],
      "analysis": [
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS",
        "POLICY_EVALUATION",
        "RESOURCE_REPORTING",
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_VERSION"
      ],
      "packaging": [
        "APPLICATION",
        "AZURE_PIPELINE_EXTENSION"
      ],
      "library": [
        "GO",
        "JAVASCRIPT_TYPESCRIPT"
      ],
      "platform": [
        "LINUX",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "C/C++"
      ],
      "_fromFile": "procap360.json"
    },
    {
      "name": "Product Security Hub (PSH)",
      "publisher": "Product Security Hub, LLC",
      "description": "Cloud-based tool to import, export, view, create, edit, and transform CycloneDX SBOMs and human-readable SBOMs, as well as manage VEX data.",
      "website_url": "https://www.ProductSecurityHub.com/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "AUTHOR",
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "_fromFile": "product_security_hub_psh_.json"
    },
    {
      "name": "Project Piper",
      "publisher": "SAP",
      "description": "Project Piper is an open-source Jenkins shared library and CLI that automates SAP-centric CI/CD pipelines and can generate CycloneDX SBOMs for Maven, Python, Go, container, and other builds.",
      "repository_url": "https://github.com/SAP/jenkins-library",
      "website_url": "https://www.project-piper.io/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [],
      "transform": [],
      "packaging": [
        "LIBRARY",
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "JAVA",
        "PYTHON",
        "GO",
        "JAVASCRIPT/TYPESCRIPT"
      ],
      "_fromFile": "project_piper.json"
    },
    {
      "name": "Provenant",
      "publisher": "Provenant contributors",
      "description": "Fast license, copyright, package, and SBOM scanner in Rust. Emits CycloneDX and SPDX with a complete, closed, purl-keyed dependency inventory. Static and offline: no execution of scanned code or package-manager code.",
      "repository_url": "https://github.com/getprovenant/provenant",
      "website_url": "https://getprovenant.dev",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "LICENSE_REPORTING",
        "RESOURCE_REPORTING",
        "POLICY_EVALUATION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION"
      ],
      "library": [
        "RUST"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7"
      ],
      "supportedLanguages": [
        "C/C++",
        ".NET",
        "ERLANG_ELIXIR",
        "GO",
        "GROOVY",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "KOTLIN",
        "NODE.JS",
        "PERL",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SWIFT"
      ],
      "_fromFile": "provenant.json"
    },
    {
      "name": "PulseUno Plugin for Dimensions CM",
      "publisher": "Micro Focus",
      "description": "PulseUno enables development teams to continually build and inspect the health and quality of code using plugins such as CycloneDX. Teams can use this information for merge, deployment, and release decisions.",
      "repository_url": "https://www.microfocus.com/en-us/products/dimensions-cm",
      "website_url": "https://www.microfocus.com/en-us/products/dimensions-cm",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION",
        "ANALYSIS"
      ],
      "analysis": [
        "RESOURCE_REPORTING"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [],
      "_fromFile": "pulseuno_plugin_for_dimensions_cm.json"
    },
    {
      "name": "Qinsight Atlas",
      "publisher": "Qinsight",
      "description": "Cryptographic posture management platform that discovers, inventories and analyzes cryptographic assets across environments, can import/export CycloneDX-aligned CBOMs, and prioritizes remediation for PQC readiness.",
      "website_url": "https://qinsight.com",
      "capabilities": [
        "CBOM"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "availability": [
        "COMMERCIAL_LICENSE",
        "SUBSCRIPTION"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "lifecycle": [
        "DISCOVERY",
        "OPERATIONS"
      ],
      "_fromFile": "qinsight-atlas.json"
    },
    {
      "website_url": "https://github.com/StanimirTenev/qrp-mcp",
      "repository_url": "https://github.com/StanimirTenev/qrp-mcp",
      "name": "qrp-mcp",
      "publisher": "Elkan Electronic",
      "description": "Offline scanner for quantum-vulnerable crypto in source code and config. Reports its own coverage \u2014 the files it read and those it couldn't \u2014 and emits a CycloneDX CBOM. Runs locally via uvx; free and open source. For PQC readiness and DORA evidence.",
      "capabilities": [
        "CBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "DISCOVERY",
        "OPERATIONS"
      ],
      "supportedLanguages": [
        "C/C++",
        ".NET",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST"
      ],
      "_fromFile": "qrp-mcp.json"
    },
    {
      "name": "quantakrypto pqc-tools",
      "publisher": "quantakrypto / Dandelion Labs",
      "description": "Scans source code for quantum-vulnerable cryptography and generates CycloneDX CBOMs. Reports a post-quantum readiness score with NIST-based migration guidance. Ships as a CLI, a GitHub Action, and an MCP server.",
      "repository_url": "https://github.com/quantakrypto/pqc-tools",
      "website_url": "https://quantakrypto.com/tools",
      "capabilities": [
        "CBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT",
        "NODE.JS"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "GITHUB_ACTION",
        "LIBRARY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "C/C++",
        ".NET",
        "ERLANG_ELIXIR",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "KOTLIN",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SCALA",
        "SWIFT"
      ],
      "_fromFile": "quantakrypto-pqc-tools.json"
    },
    {
      "name": "RapidFort",
      "publisher": "RapidFort",
      "description": "Container-optimization platform that scans, profiles and hardens images, generates SBOMs, converts to CycloneDX/SPDX, and exports VEX to prioritize exploitable CVEs.",
      "website_url": "https://www.rapidfort.com/",
      "repository_url": "https://github.com/rapidfort/community-images",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM",
        "PACKAGE_MANAGER_INTEGRATION",
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "_fromFile": "rapidfort.json"
    },
    {
      "name": "ReARM",
      "publisher": "Reliza",
      "description": "ReARM is a system to store, organize and manage SBOMs / xBOMs with Component and Product releases.",
      "repository_url": "https://github.com/relizaio/rearm",
      "website_url": "https://rearmhq.com",
      "capabilities": [
        "AI/ML-BOM",
        "CBOM",
        "CDXA",
        "OBOM",
        "RELEASE_NOTES",
        "SAASBOM",
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED",
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "library": [
        "JAVA"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD",
        "OPERATIONS",
        "DECOMMISSION"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        ".NET",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "PYTHON",
        "GO",
        "NODE.JS"
      ],
      "_fromFile": "rearm.json"
    },
    {
      "name": "Rebom",
      "publisher": "Reliza",
      "description": "Open source catalog for storing, managing, and distributing CycloneDX Software Bills of Materials (SBOMs) in JSON format, with features for validation, merging, and analysis.",
      "repository_url": "https://github.com/relizaio/rebom",
      "website_url": "https://rebomdemo.relizahub.com",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "DISTRIBUTE",
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "LICENSE_REPORTING",
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [
        "BOM_VERSION",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "CONTAINER_IMAGE",
        "APPLICATION"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "OPERATIONS",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.3"
      ],
      "supportedLanguages": [
        "JAVASCRIPT/TYPESCRIPT"
      ],
      "_fromFile": "rebom.json"
    },
    {
      "name": "Reliza Hub",
      "publisher": "Reliza",
      "description": "Publishes and ingests SBOMs for metadata management, compliance, and distribution. Supports CycloneDX and SPDX standards for software supply chain transparency.",
      "repository_url": "https://relizahub.com/",
      "website_url": "https://relizahub.com/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "DISTRIBUTE",
        "ANALYSIS"
      ],
      "analysis": [
        "RESOURCE_REPORTING",
        "LICENSE_REPORTING"
      ],
      "transform": [],
      "packaging": [
        "APPLICATION"
      ],
      "library": [],
      "platform": [
        "LINUX",
        "WINDOWS",
        "MAC"
      ],
      "lifecycle": [
        "POST-BUILD",
        "DISCOVERY",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [],
      "_fromFile": "reliza_hub.json"
    },
    {
      "name": "Retire.js",
      "publisher": "RetireJS",
      "description": "Scanner that detects the use of JavaScript libraries with known vulnerabilities in web and Node.js applications and can generate CycloneDX-format SBOMs.",
      "repository_url": "https://github.com/RetireJS/retire.js",
      "website_url": "https://retirejs.github.io/retire.js",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT",
        "NODE.JS"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "JAVASCRIPT/TYPESCRIPT",
        "NODE.JS"
      ],
      "_fromFile": "retire_js.json"
    },
    {
      "name": "Rezilion Dynamic SBOM",
      "publisher": "Rezilion",
      "description": "Continuous, runtime-aware SBOM platform that inventories every file, package and dependency across Windows and Linux hosts, containers and CI/CD pipelines, exports CycloneDX/VEX and validates vulnerability exploitability in real time.",
      "website_url": "https://www.rezilion.com/platform/dynamic-sbom",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "SUBSCRIPTION",
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "APPLICATION",
        "JENKINS_PLUGIN",
        "GITLAB_CI_TEMPLATE"
      ],
      "platform": [
        "LINUX",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PYTHON",
        "RUBY"
      ],
      "_fromFile": "rezilion_dynamic_sbom.json"
    },
    {
      "name": "RKVST SBOM Hub",
      "publisher": "RKVST",
      "description": "Free SaaS repository to discover, store and permission-share CycloneDX v1.4 SBOMs with immutable provenance, VEX support and continuous assurance.",
      "repository_url": "https://github.com/jitsuin-inc/archivist-samples",
      "website_url": "https://www.datatrails.ai/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "FREEMIUM"
      ],
      "functions": [
        "DISTRIBUTE",
        "SIGNING/NOTARY"
      ],
      "analysis": [],
      "transform": [],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SWID"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [
        "PYTHON"
      ],
      "_fromFile": "rkvst_sbom_hub.json"
    },
    {
      "name": "Rollup Plugin SBOM",
      "publisher": "Jan Biasi",
      "description": "Creates CycloneDX SBOMs for frontend Javascript apps bundled with rollup or vite.",
      "repository_url": "https://github.com/janbiasi/rollup-plugin-sbom",
      "website_url": "https://www.npmjs.com/package/rollup-plugin-sbom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [
        "JAVASCRIPT/TYPESCRIPT"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "packaging": [
        "ROLLUP_PLUGIN"
      ],
      "_fromFile": "rollup_plugin_sbom.json"
    },
    {
      "name": "RunSafe C/C++ Build-time SBOM Generator",
      "publisher": "RunSafe Security",
      "description": "Generates a C/C++ SBOM at build-time without a package manager, working across build environments and reporting on all library dependencies.",
      "website_url": "https://runsafesecurity.com/cyclonedx-sbom/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "packaging": [
        "GITHUB_ACTION"
      ],
      "library": [
        "C/C++"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3"
      ],
      "supportedLanguages": [
        "C/C++"
      ],
      "_fromFile": "runsafe_c_c_build_time_sbom_generator.json"
    },
    {
      "name": "Salus",
      "publisher": "Coinbase",
      "description": "Salus is a tool for coordinating the execution of security scanners. Salus can generate CycloneDX SBOMs from many language ecosystems.",
      "repository_url": "https://github.com/coinbase/salus",
      "website_url": "https://github.com/coinbase/salus",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "POLICY_EVALUATION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "supportedLanguages": [
        "RUBY",
        "JAVASCRIPT/TYPESCRIPT",
        "NODE.JS",
        "PYTHON",
        "GO",
        "RUST"
      ],
      "_fromFile": "salus.json"
    },
    {
      "name": "Sapper",
      "publisher": "Perruer",
      "description": "Dependency graph of the SBOMs of all your products plus OSV advisories: reports which products each vulnerability reaches and through which path, ranked by CISA KEV and EPSS, with OpenVEX. Continuation of Minefield.",
      "repository_url": "https://github.com/Perruer/sapper",
      "website_url": "https://github.com/Perruer/sapper",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3"
      ],
      "supportedLanguages": [],
      "_fromFile": "sapper.json"
    },
    {
      "name": "SBOM2doc",
      "publisher": "Anthony Harrison",
      "description": "SBOM2doc converts CycloneDX or SPDX SBOMs into human-readable reports in PDF, Markdown, HTML, Excel or console formats via a cross-platform Python CLI.",
      "repository_url": "https://github.com/anthonyharrison/sbom2doc",
      "website_url": "https://pypi.org/project/sbom2doc/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "TRANSFORM",
        "ANALYSIS"
      ],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "transform": [],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "CPE",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "_fromFile": "sbom2doc.json"
    },
    {
      "name": "SBOM2dot",
      "publisher": "Anthony Harrison",
      "description": "CLI that reads CycloneDX or SPDX SBOMs and emits a GraphViz-compatible DOT file so you can visualise component and dependency relationships.",
      "repository_url": "https://github.com/anthonyharrison/sbom2dot",
      "website_url": "https://pypi.org/project/sbom2dot/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "TRANSFORM",
        "ANALYSIS"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "_fromFile": "sbom2dot.json"
    },
    {
      "name": "SBOM4Files",
      "publisher": "Anthony Harrison",
      "description": "Command-line tool that scans a directory and generates CycloneDX (JSON) or SPDX SBOMs for its files.",
      "repository_url": "https://github.com/anthonyharrison/sbom4files",
      "website_url": "https://pypi.org/project/sbom4files/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "_fromFile": "sbom4files.json"
    },
    {
      "name": "SBOM4Python",
      "publisher": "Anthony Harrison",
      "description": "CLI utility that produces CycloneDX or SPDX SBOMs for installed Python modules or requirements files, identifying dependencies and their licenses, with optional dependency graph output.",
      "repository_url": "https://github.com/anthonyharrison/sbom4python",
      "website_url": "https://pypi.org/project/sbom4python/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [],
      "analysis": [
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_STANDARD"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "PRE-BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "PYTHON"
      ],
      "_fromFile": "sbom4python.json"
    },
    {
      "name": "SBOM4Rust",
      "publisher": "Anthony Harrison",
      "description": "CLI that reads Cargo.lock and authors CycloneDX or SPDX SBOMs for Rust projects.",
      "repository_url": "https://github.com/anthonyharrison/sbom4rust",
      "website_url": "https://github.com/anthonyharrison/sbom4rust",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "RUST"
      ],
      "_fromFile": "sbom4rust.json"
    },
    {
      "name": "sbom-action",
      "publisher": "Pete Wagner",
      "description": "GitHub Action that fetches and diffs CycloneDX SBOMs for container images, posting comments or opening pull requests when package or vulnerability changes are detected.",
      "repository_url": "https://github.com/thepwagner/sbom-action",
      "website_url": "https://github.com/thepwagner/sbom-action",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "OUTDATED_COMPONENTS"
      ],
      "packaging": [
        "GITHUB_ACTION"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "_fromFile": "sbom_action.json"
    },
    {
      "name": "SBOM Assembler",
      "publisher": "Interlynk.io",
      "description": "sbomasm is a command-line tool that assembles product SBOMs from component SBOMs, supporting CycloneDX and SPDX formats for streamlined management and distribution.",
      "repository_url": "https://github.com/interlynk-io/sbomasm",
      "website_url": "https://www.interlynk.io/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "TRANSFORM"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "GO"
      ],
      "_fromFile": "sbom_assembler.json"
    },
    {
      "name": "SBOM Benchmark",
      "publisher": "Interlynk.io",
      "description": "SBOM Benchmark is an Apache-licensed web application that scores CycloneDX 1.4/1.5 and SPDX SBOMs for quality and compliance, generating shareable reports via the sbomqs engine.",
      "repository_url": "https://github.com/interlynk-io/sbombenchmark.dev",
      "website_url": "https://sbombenchmark.dev/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED",
        "FREEMIUM"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE"
      ],
      "analysis": [
        "POLICY_EVALUATION",
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "_fromFile": "sbom_benchmark.json"
    },
    {
      "name": "SBOM CLI",
      "publisher": "Defense Unicorns",
      "description": "Creates CycloneDX SBOMs from Kubernetes Helm charts",
      "capabilities": [],
      "availability": [],
      "functions": [],
      "packaging": [],
      "platform": [],
      "lifecycle": [],
      "supportedStandards": [],
      "cycloneDxVersion": [],
      "supportedLanguages": [],
      "_fromFile": "sbom_cli.json"
    },
    {
      "name": "SBOM Explorer",
      "publisher": "Interlynk.io",
      "description": "sbomex is a command line utility to help query and pull from Interlynk's public SBOM repository.",
      "repository_url": "https://github.com/interlynk-io/sbomex",
      "website_url": "https://www.interlynk.io/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "DISTRIBUTE"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "_fromFile": "sbom_explorer.json"
    },
    {
      "name": "SBOM Grep",
      "publisher": "Interlynk.io",
      "description": "Command-line utility (`sbomgr`) that performs grep-style searches across SBOMs by name, checksum, CPE, and PURL.",
      "repository_url": "https://github.com/interlynk-io/sbomgr",
      "website_url": "https://www.interlynk.io/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "_fromFile": "sbom_grep.json"
    },
    {
      "name": "SBOM-HQ",
      "publisher": "Eracent Inc.",
      "description": "Analyzes SBOMs for vulnerabilities, licenses, and component lifecycle. Offers advanced built-in and customizable reports, alerting, and fine-grained access control. Scales from small teams to large enterprises.",
      "website_url": "https://sbomhq.com/",
      "capabilities": [
        "SBOM",
        "CBOM",
        "VDR/VEX"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS",
        "POLICY_EVALUATION",
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_VERSION"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "library": [
        "C#",
        ".NET",
        "JAVASCRIPT_TYPESCRIPT"
      ],
      "platform": [
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [],
      "_fromFile": "sbom_hq.json"
    },
    {
      "name": "SBOM Insights",
      "publisher": "Revenera",
      "description": "SBOM Insights is a subscription-based SaaS platform that ingests SBOMs in CycloneDX and SPDX formats, reconciles and analyzes components for vulnerabilities, license compliance and outdated parts, and generates reports and compliance artifacts.",
      "website_url": "https://www.revenera.com/software-composition-analysis/products/sbom-insights",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM",
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "_fromFile": "sbom_insights.json"
    },
    {
      "name": "SBOM Lens",
      "publisher": "EverBright IT",
      "description": "Client-side viewer for CycloneDX and SPDX SBOMs: resolves multi-document cascades into one tree, overlays VEX (OpenVEX, CSAF 2.0), diffs releases, checks NTIA / BSI TR-03183 profiles. Files never leave the machine.",
      "repository_url": "https://github.com/EverBright-IT/SBOM-Lens",
      "website_url": "https://sbom-lens.everbright-it.de/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "POLICY_EVALUATION",
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "CONTAINER_IMAGE",
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL",
        "CPE"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.6"
      ],
      "_fromFile": "sbom_lens.json"
    },
    {
      "name": "SBOM-Manager",
      "publisher": "Anthony Harrison",
      "description": "SBOM-Manager is an open-source Python CLI that stores, queries, and scans CycloneDX and SPDX SBOMs via a local repository to support audit and vulnerability investigations.",
      "repository_url": "https://github.com/anthonyharrison/sbom-manager",
      "website_url": "https://pypi.org/project/sbom-manager/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "_fromFile": "sbom_manager.json"
    },
    {
      "name": "SBOM Observer",
      "publisher": "Bytesafe",
      "description": "SBOM Observer provides a comprehensive SBOM workflow to help you manage your software supply chain. Leverage the powerful combination of the Policy Engine and Operational Model to guarantee the security and compliance of your software.",
      "website_url": "https://sbom.observer/",
      "repository_url": "https://github.com/marketplace/actions/sbom-observer-scan-and-upload",
      "capabilities": [
        "SBOM",
        "RELEASE_NOTES",
        "VDR/VEX"
      ],
      "availability": [
        "SUBSCRIPTION",
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE",
        "PACKAGE_MANAGER_INTEGRATION",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "RESOURCE_REPORTING",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT",
        "BOM_VERSION"
      ],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY",
        "GITHUB_ACTION",
        "CONTAINER_IMAGE"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "SLSA"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PERL",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SWIFT",
        "ERLANG_ELIXIR",
        "SCALA",
        "KOTLIN",
        "GROOVY",
        "FORTRAN"
      ],
      "_fromFile": "sbom_observer.json"
    },
    {
      "name": "SBOM-Operator",
      "publisher": "Christian Kotzbauer",
      "description": "Catalogue all container images running in a Kubernetes cluster and publish Software Bill of Materials (SBOM) documents, generated with Syft, to multiple back-ends.",
      "repository_url": "https://github.com/ckotzbauer/sbom-operator",
      "website_url": "https://github.com/ckotzbauer/sbom-operator",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE"
      ],
      "analysis": [],
      "transform": [],
      "packaging": [
        "CONTAINER_IMAGE"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [],
      "_fromFile": "sbom_operator.json"
    },
    {
      "name": "SBOM Quality Score",
      "publisher": "Interlynk.io",
      "description": "Command-line utility that evaluates the quality and compliance of CycloneDX and SPDX SBOMs across multiple categories, enabling automated policy gates in CI/CD workflows.",
      "repository_url": "https://github.com/interlynk-io/sbomqs",
      "website_url": "https://www.interlynk.io/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "POLICY_EVALUATION",
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "_fromFile": "sbom_quality_score.json"
    },
    {
      "name": "sbom-rs",
      "publisher": "Paul Sastrasinh",
      "description": "A group of Rust projects for interacting with and producing software bill of materials (SBOMs).",
      "repository_url": "https://github.com/psastras/sbom-rs",
      "website_url": "https://github.com/psastras/sbom-rs",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "GITHUB_ACTION"
      ],
      "library": [
        "RUST"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "RUST"
      ],
      "_fromFile": "sbom_rs.json"
    },
    {
      "name": "SBOM Scorecard",
      "publisher": "eBay",
      "description": "SBOM Scorecard evaluates SBOMs for specification compliance, generation metadata, and package details, supporting CycloneDX, SPDX, and Syft formats.",
      "repository_url": "https://github.com/eBay/sbom-scorecard",
      "website_url": "https://github.com/eBay/sbom-scorecard",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "library": [
        "GO"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3"
      ],
      "supportedLanguages": [
        "GO"
      ],
      "_fromFile": "sbom_scorecard.json"
    },
    {
      "name": "SBOM.sh",
      "publisher": "Codenotary Inc",
      "description": "SBOM.sh is a free service to store, visualize and globally share CycloneDX SBOM files by simply using HTTP requests or curl.",
      "repository_url": "https://github.com/codenotary/sbom.sh-container",
      "website_url": "https://sbom.sh",
      "capabilities": [
        "SBOM",
        "RELEASE_NOTES"
      ],
      "availability": [
        "OPEN_SOURCE",
        "FREEMIUM"
      ],
      "functions": [
        "DISTRIBUTE",
        "SIGNING/NOTARY"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION"
      ],
      "library": [
        "SHELL"
      ],
      "platform": [
        "LINUX"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3"
      ],
      "supportedLanguages": [
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST"
      ],
      "_fromFile": "sbom_sh.json"
    },
    {
      "name": "sbom-submission-action",
      "publisher": "TietoEVRY",
      "description": "GitHub Action that uploads CycloneDX SBOM files to GitHub\u2019s dependency submission API, enabling Dependabot security analysis downstream.",
      "repository_url": "https://github.com/evryfs/sbom-dependency-submission-action",
      "website_url": "https://github.com/marketplace/actions/sbom-submission-action",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "DISTRIBUTE"
      ],
      "analysis": [],
      "transform": [],
      "packaging": [
        "GITHUB_ACTION"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [],
      "_fromFile": "sbom_submission_action.json"
    },
    {
      "name": "sbom-swissarmy-bitbucket-pipe",
      "publisher": "ShiftLeftCyber",
      "description": "A Bitbucket Pipe containing a collection of open source tools to perform additional analysis on a CycloneDX or SPDX SBOM.",
      "repository_url": "https://github.com/shiftleftcyber/sbom-utilities-pipe",
      "website_url": "https://shiftleftcyber.io",
      "capabilities": [
        "SBOM",
        "SAASBOM",
        "CBOM",
        "AI/ML-BOM",
        "HBOM",
        "MBOM",
        "OBOM",
        "RELEASE_NOTES",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE",
        "PACKAGE_MANAGER_INTEGRATION",
        "TRANSFORM",
        "SIGNING/NOTARY"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "RESOURCE_REPORTING",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT",
        "BOM_VERSION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "DESIGN",
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY",
        "DECOMMISSION"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL",
        "CPE",
        "OMNIBOR",
        "SWID"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PERL",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SWIFT",
        "ERLANG_ELIXIR",
        "SCALA",
        "KOTLIN",
        "GROOVY",
        "FORTRAN"
      ],
      "_fromFile": "sbom_swissarmy_bitbucket_pipe.json"
    },
    {
      "name": "SBOM Utility (sbom-utility)",
      "publisher": "CycloneDX",
      "description": "Go-based CLI and API to validate, query, trim and patch CycloneDX or SPDX BOMs, report on components, licences and vulnerabilities, and handle all CycloneDX variants up to v1.6.",
      "repository_url": "https://github.com/CycloneDX/sbom-utility",
      "website_url": "https://github.com/CycloneDX/sbom-utility",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "POLICY_EVALUATION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "_fromFile": "sbom_utility_sbom_utility_.json"
    },
    {
      "name": "sbom-validator",
      "publisher": "ShiftLeftCyber",
      "description": "A lightweight Go library for validating Software Bill of Materials (SBOM) against industry-standard specifications.",
      "repository_url": "https://github.com/shiftleftcyber/sbom-validator",
      "website_url": "https://shiftleftcyber.io",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "LIBRARY"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.2"
      ],
      "supportedLanguages": [
        "GO"
      ],
      "_fromFile": "sbom_validator.json"
    },
    {
      "name": "SBOM Vendor Management",
      "publisher": "SettleTop, Inc.",
      "description": "Manage, assess, store and monitor all your vendor\u2019s SBOMs in one secure, centralized dashboard to improve supply chain security.",
      "website_url": "https://www.settletop.com/sbom",
      "repository_url": "https://www.settletop.com/sbom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "OPERATIONS",
        "DISCOVERY"
      ],
      "_fromFile": "sbom_vendor_management.json"
    },
    {
      "name": "SBOMAudit",
      "publisher": "Anthony Harrison",
      "description": "SBOMAudit is a command-line utility that audits CycloneDX or SPDX SBOMs against NTIA minimum requirements, license policies, allow/deny lists, and package age to flag outdated or non-compliant components.",
      "repository_url": "https://github.com/anthonyharrison/sbomaudit",
      "website_url": "https://pypi.org/project/sbomaudit/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "POLICY_EVALUATION",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "CPE",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PERL",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SWIFT"
      ],
      "_fromFile": "sbomaudit.json"
    },
    {
      "name": "SBOMDiff",
      "publisher": "Anthony Harrison",
      "description": "SBOMDiff is an Apache-2.0 CLI that compares two SBOM files (CycloneDX or SPDX), highlighting package additions, removals, version or license changes, and outputs text, JSON or YAML reports.",
      "repository_url": "https://github.com/anthonyharrison/sbomdiff",
      "website_url": "https://pypi.org/project/sbomdiff/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "_fromFile": "sbomdiff.json"
    },
    {
      "name": "SBOMHub CLI",
      "publisher": "SBOMHub",
      "description": "CLI tool that wraps Syft, Trivy, and cdxgen to generate SBOMs and upload them to SBOMHub with vulnerability scanning support.",
      "repository_url": "https://github.com/youichi-uda/sbomhub-cli",
      "website_url": "https://sbomhub.app",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "DISTRIBUTE"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST"
      ],
      "_fromFile": "sbomhub_cli.json"
    },
    {
      "name": "sbomify",
      "publisher": "sbomify",
      "description": "sbomify is a comprehensive SBOM management platform that enables secure sharing and analysis of Software Bill of Materials. Seamlessly integrates with CI/CD pipelines.",
      "website_url": "https://sbomify.com",
      "repository_url": "https://github.com/sbomify/sbomify",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE",
        "TRANSFORM"
      ],
      "library": [
        "PYTHON"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "APPLICATION",
        "GITHUB_ACTION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [
        "JAVASCRIPT/TYPESCRIPT"
      ],
      "_fromFile": "sbomify.json"
    },
    {
      "name": "SBOMlyze",
      "publisher": "rezmoss",
      "description": "Open-source CLI and GitHub Action that compares CycloneDX, SPDX, and Syft SBOMs; detects same-version hash drift, dependency-graph, license, and compliance regressions; and gates pull requests with policy and SARIF.",
      "repository_url": "https://github.com/rezmoss/sbomlyze",
      "website_url": "https://sbomlyze.com/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "LICENSE_REPORTING",
        "POLICY_EVALUATION"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT",
        "BOM_STANDARD"
      ],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY",
        "GITHUB_ACTION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CPE",
        "CYCLONEDX",
        "PACKAGE_URL",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "_fromFile": "sbomlyze.json"
    },
    {
      "name": "SBOMMerge",
      "publisher": "Anthony Harrison",
      "description": "Command-line utility that merges two SBOM files, supporting CycloneDX and SPDX SBOMs and outputs in tag, JSON or YAML formats.",
      "repository_url": "https://github.com/anthonyharrison/sbommerge",
      "website_url": "https://pypi.org/project/sbommerge/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "TRANSFORM"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "_fromFile": "sbommerge.json"
    },
    {
      "name": "SBOMTrend",
      "publisher": "Anthony Harrison",
      "description": "A command line tool which analyses a set of SBOMs to identify license and version changes in components.",
      "repository_url": "https://github.com/anthonyharrison/sbomtrend",
      "website_url": "https://pypi.org/project/sbomtrend/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "library": [
        "PYTHON"
      ],
      "analysis": [],
      "transform": [
        "BOM_STANDARD"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "PYTHON"
      ],
      "_fromFile": "sbomtrend.json"
    },
    {
      "name": "sca-codeinsight-reports-cyclonedx",
      "publisher": "Flexera",
      "description": "Generates CycloneDX SBOM reports (XML and JSON) for projects scanned in Flexera Code Insight.",
      "repository_url": "https://github.com/flexera-public/sca-codeinsight-reports-cyclonedx",
      "website_url": "https://github.com/flexera-public/sca-codeinsight-reports-cyclonedx",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "_fromFile": "sca_codeinsight_reports_cyclonedx.json"
    },
    {
      "name": "Scancode Toolkit",
      "publisher": "nexB",
      "description": "Detects licenses, copyrights, package manifests & dependencies by scanning code to discover and inventory open source and third-party packages",
      "repository_url": "https://github.com/nexB/scancode-toolkit",
      "website_url": "https://github.com/nexB/scancode-toolkit",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "RESOURCE_REPORTING"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PERL",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SWIFT"
      ],
      "_fromFile": "scancode_toolkit.json"
    },
    {
      "name": "SCANOSS",
      "publisher": "SCANOSS",
      "description": "Open source software identification and inventory tool that provides insights into license compliance, security vulnerabilities, and software composition analysis",
      "repository_url": "https://github.com/scanoss/engine",
      "website_url": "https://www.scanoss.com/",
      "capabilities": [],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "supportedLanguages": [
        "C/C++",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "PYTHON"
      ],
      "_fromFile": "scanoss.json"
    },
    {
      "name": "SecObserve",
      "publisher": "Stefan Fleckenstein",
      "description": "Open-source platform that aggregates findings and CycloneDX SBOMs from many scanners, lets teams assess security and license risks, and reports results via dashboards and APIs.",
      "repository_url": "https://github.com/SecObserve/SecObserve",
      "website_url": "https://secobserve.github.io/SecObserve",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "APPLICATION",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "PYTHON",
        "JAVASCRIPT_TYPESCRIPT"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "KOTLIN"
      ],
      "_fromFile": "secobserve.json"
    },
    {
      "name": "SecureStack",
      "publisher": "SecureStack",
      "description": "SecureStack analyzes your application and finds all source code, cloud stack and third-party services and builds a CycloneDX SBOM every time you deploy",
      "repository_url": "https://github.com/SecureStackCo/actions-sbom",
      "website_url": "https://securestack.com/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "FREEMIUM",
        "SUBSCRIPTION"
      ],
      "functions": [
        "DISTRIBUTE",
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "RESOURCE_REPORTING",
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY",
        "GITHUB_ACTION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "supportedLanguages": [
        "GO",
        "JAVASCRIPT/TYPESCRIPT",
        "PYTHON"
      ],
      "_fromFile": "securestack.json"
    },
    {
      "name": "Semantic SBOM Diff (sbom-tools)",
      "publisher": "sbom-tool",
      "description": "Semantic SBOM diff and analysis tool for CycloneDX and SPDX. Compares SBOMs, enriches with vulnerability and EOL data, scores quality, checks compliance, and supports continuous watch monitoring.",
      "repository_url": "https://github.com/sbom-tool/sbom-tools",
      "website_url": "https://sbom.tools",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS",
        "POLICY_EVALUATION",
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "RUST"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "_fromFile": "semantic_sbom_diff.json"
    },
    {
      "name": "Semgrep",
      "publisher": "Semgrep Inc",
      "description": "Semgrep is an application security platform where developers can scan for vulnerabilities in code (SAST), in OSS dependencies (SCA), and secrets. Semgrep creates CycloneDX SBOMs that enrich vulnerabilities with reachability analysis.",
      "website_url": "https://semgrep.dev",
      "repository_url": "https://github.com/semgrep/semgrep",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "FREEMIUM",
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION",
        "LIBRARY"
      ],
      "library": [
        "PYTHON",
        "OCAML"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SCALA",
        "SWIFT",
        "KOTLIN",
        "GROOVY",
        "FORTRAN"
      ],
      "_fromFile": "semgrep.json"
    },
    {
      "name": "ShieldBOM",
      "publisher": "kazu11max17",
      "description": "SBOM vulnerability scanner for embedded & IoT systems. Supports SPDX/CycloneDX, OSV.dev integration, assists with EU CRA SBOM requirements. Written in Rust.",
      "repository_url": "https://github.com/kazu11max17/shieldbom",
      "website_url": "https://github.com/kazu11max17/shieldbom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "_fromFile": "shieldbom.json"
    },
    {
      "name": "ShiftLeft Scan",
      "publisher": "ShiftLeft",
      "description": "A free open-source security tool for modern DevOps teams that performs static analysis-based security testing across multiple languages and frameworks",
      "repository_url": "https://github.com/ShiftLeftSecurity/sast-scan",
      "website_url": "https://www.shiftleft.io/scan/",
      "capabilities": [],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "PACKAGE_URL"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST"
      ],
      "_fromFile": "shiftleft_scan.json"
    },
    {
      "name": "SnapSBOM",
      "publisher": "kawacukennedy",
      "description": "Deterministic SBOM generator for npm projects. Reads package-lock.json (lockfile v1-v3) and emits SPDX 2.3 or CycloneDX 1.6 that is byte-for-byte reproducible. Offline, no build required.",
      "repository_url": "https://github.com/kawacukennedy/snapsbom",
      "website_url": "https://kawacukennedy.github.io/snapsbom/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "RUST"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "NODE.JS",
        "JAVASCRIPT/TYPESCRIPT"
      ],
      "_fromFile": "snapsbom.json"
    },
    {
      "name": "Snyk",
      "publisher": "Snyk",
      "description": "Snyk generates and scans BOMs providing visibility and risk insights into your software supply chain.",
      "repository_url": "",
      "website_url": "https://snyk.io",
      "availability": [
        "FREEMIUM",
        "SUBSCRIPTION"
      ],
      "capabilities": [
        "SBOM"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "supportedLanguages": [
        "C/C++",
        ".NET",
        "ERLANG_ELIXIR",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "PYTHON",
        "PHP",
        "RUBY",
        "RUST",
        "SCALA",
        "SWIFT"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "POST-BUILD",
        "BUILD"
      ],
      "_fromFile": "snyk.json"
    },
    {
      "name": "SnykVulnCheck",
      "publisher": "Andrii Grytsenko",
      "description": "Command-line tool that analyzes CycloneDX SBOMs and evaluates components for known vulnerabilities by querying the public Snyk Vulnerability Database API.",
      "repository_url": "https://github.com/Andrii-Grytsenko-OWASP/SnykVulnCheck",
      "website_url": "https://github.com/Andrii-Grytsenko-OWASP/SnykVulnCheck",
      "capabilities": [
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.3"
      ],
      "supportedLanguages": [
        "PYTHON"
      ],
      "_fromFile": "snykvulncheck.json"
    },
    {
      "name": "Socket",
      "publisher": "Socket",
      "description": "Supply Chain Security platform. Next-gen SCA + SBOM + 0-day prevention.",
      "website_url": "https://socket.dev",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "FREEMIUM",
        "SUBSCRIPTION",
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY",
        "GITHUB_ACTION",
        "GITHUB_APP",
        "GITLAB_CI_TEMPLATE"
      ],
      "library": [],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "DESIGN",
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [
        "C/C++",
        ".NET",
        "ERLANG_ELIXIR",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "KOTLIN",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SCALA",
        "SWIFT"
      ],
      "_fromFile": "socket.json"
    },
    {
      "name": "Software Assurance Guardian Point Man",
      "publisher": "Reliable Energy Analytics LLC",
      "description": "A patented tool that performs comprehensive software supply chain risk assessments using a 7-step process to detect vulnerabilities and calculate trustworthiness scores for software.",
      "website_url": "https://reliableenergyanalytics.com/products",
      "repository_url": "https://reliableenergyanalytics.com/products",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "library": [],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [],
      "_fromFile": "software_assurance_guardian_point_man.json"
    },
    {
      "name": "Sonar Cryptography Plugin",
      "publisher": "IBM",
      "description": "A SonarQube Plugin that detects cryptographic assets in source code and generates CBOM.",
      "repository_url": "https://github.com/IBM/sonar-cryptography",
      "website_url": "https://github.com/IBM/sonar-cryptography",
      "capabilities": [
        "CBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "packaging": [
        "JENKINS_PLUGIN"
      ],
      "library": [
        "JAVA"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "JAVA",
        "PYTHON"
      ],
      "_fromFile": "sonar_cryptography_plugin.json"
    },
    {
      "name": "SonarQube",
      "publisher": "SonarSource",
      "description": "SonarQube allows developers and development teams to write clean code and remediate existing code organically, so they can focus on the work they love and maximize the value they generate for businesses.",
      "repository_url": "https://github.com/SonarSource/sonarqube",
      "website_url": "https://www.sonarsource.com/products/sonarqube/",
      "availability": [
        "OPEN_SOURCE",
        "FREEMIUM",
        "COMMERCIAL_LICENSE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION"
      ],
      "packaging": [
        "APPLICATION",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "JAVA"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY",
        "SWIFT",
        "SCALA",
        "KOTLIN"
      ],
      "_fromFile": "sonarqube.json"
    },
    {
      "name": "SonarQube Advanced Security",
      "publisher": "Sonar",
      "description": "Secure your entire codebase\u2014first-party, third-party, and everything in between. Seamlessly integrated into your workflow, SonarQube detects and fixes vulnerabilities, ensures license compliance, and generates Software Bills of Materials",
      "website_url": "https://sonarsource.com/solutions/security",
      "capabilities": [
        "SBOM",
        "CDXA"
      ],
      "availability": [
        "COMMERCIAL_LICENSE",
        "SUBSCRIPTION"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS",
        "POLICY_EVALUATION",
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_VERSION"
      ],
      "packaging": [
        "APPLICATION",
        "AZURE_PIPELINE_EXTENSION",
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION",
        "GITLAB_CI_TEMPLATE",
        "JENKINS_PLUGIN",
        "MAVEN_PLUGIN"
      ],
      "library": [
        "JAVA",
        "JAVASCRIPT_TYPESCRIPT"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        ".NET",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "KOTLIN",
        "NODE.JS",
        "PYTHON",
        "RUBY",
        "RUST",
        "SCALA"
      ],
      "_fromFile": "sonarqube_advanced_security.json"
    },
    {
      "name": "Sonatype Lift",
      "publisher": "Sonatype",
      "description": "Cloud-native, collaborative code analysis platform that analyzes pull requests to find and fix security, performance, reliability, and style issues while generating CycloneDX SBOMs.",
      "website_url": "https://lift.sonatype.com/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "COMMERCIAL_LICENSE",
        "FREEMIUM"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING"
      ],
      "transform": [],
      "packaging": [
        "GITHUB_APP",
        "APPLICATION"
      ],
      "library": [],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "PYTHON",
        "GO",
        "PHP",
        "RUBY"
      ],
      "_fromFile": "sonatype_lift.json"
    },
    {
      "name": "SOOS",
      "publisher": "SOOS",
      "description": "Automate your software inventory. SOOS creates, ingests, and manages your Software Bill of Materials and uses patented SCA and the largest open-source SBOM database to find hidden vulnerabilities, license issues, and dependencies sooner.",
      "website_url": "https://soos.io",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "SUBSCRIPTION",
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT",
        "BOM_VERSION"
      ],
      "packaging": [
        "GITHUB_ACTION",
        "GITHUB_APP",
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT",
        "JAVA",
        ".NET",
        "PYTHON",
        "RUBY",
        "PHP"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "JAVA",
        "PYTHON",
        "RUBY",
        "PHP"
      ],
      "_fromFile": "soos.json"
    },
    {
      "name": "Spack",
      "publisher": "Spack",
      "description": "HPC package manager for Linux and macOS; the spack-sbom plug-in exports CycloneDX SBOMs for any concretized spec.",
      "repository_url": "https://github.com/spack/spack-sbom",
      "website_url": "https://spack.io/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION",
        "TRANSFORM"
      ],
      "analysis": [],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.3"
      ],
      "supportedLanguages": [
        "C/C++",
        "FORTRAN",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "PYTHON",
        "RUST",
        "SWIFT"
      ],
      "_fromFile": "spack.json"
    },
    {
      "name": "spdxcyclone",
      "publisher": "SPDX",
      "description": "Java utility that converts Software Bill of Materials (SBOM) documents from CycloneDX format to SPDX format, supporting multiple serialization options for both standards.",
      "repository_url": "https://github.com/spdx/cdx2spdx",
      "website_url": "https://github.com/spdx/cdx2spdx",
      "capabilities": [],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "TRANSFORM"
      ],
      "analysis": [],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "JAVA"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [],
      "_fromFile": "spdxcyclone.json"
    },
    {
      "name": "Spectra Assure",
      "publisher": "ReversingLabs",
      "description": "Spectra Assure scans binary software packages, container images, and VM disk images to detect malware, tampering, vulnerabilities, and other exposures. CycloneDX SBOM, SaaSBOM, ML-BOM, and CBOM are outputs.",
      "repository_url": "https://github.com/reversinglabs/spectra-assure-sdk",
      "website_url": "https://www.reversinglabs.com/products/software-supply-chain-security",
      "capabilities": [
        "SBOM",
        "SAASBOM",
        "CBOM",
        "AI/ML-BOM",
        "VDR/VEX"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION",
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION",
        "GITLAB_CI_TEMPLATE",
        "AZURE_PIPELINE_EXTENSION",
        "LIBRARY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CPE",
        "CYCLONEDX",
        "PACKAGE_URL",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PYTHON",
        "PHP",
        "RUBY",
        "RUST"
      ],
      "_fromFile": "spectra_assure.json"
    },
    {
      "name": "SRC:CLR SBOM Generator",
      "publisher": "Veracode",
      "description": "Generates a Software Bill of Materials in CycloneDX JSON Format from Veracode SCA Agent results",
      "repository_url": "https://github.com/veracode/srcclr_sbom_gen",
      "website_url": "https://github.com/veracode/srcclr_sbom_gen",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "TRANSFORM"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "transform": [
        "BOM_STANDARD"
      ],
      "_fromFile": "src_clr_sbom_generator.json"
    },
    {
      "name": "StackAware",
      "publisher": "StackAware",
      "description": "StackAware is a SaaS platform for managing CycloneDX 1.4/1.5 and SPDX SBOMs, enriching them with VEX data, and securely distributing both SBOMs and SaaSBOMs for supply-chain risk analysis.",
      "website_url": "https://stackaware.com/",
      "capabilities": [
        "SBOM",
        "SAASBOM",
        "VDR/VEX"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "_fromFile": "stackaware.json"
    },
    {
      "name": "Startup-SBOM",
      "publisher": "morpheuslord",
      "description": "Static and dynamic analyser for Linux root filesystems, container images and running systems. Maps boot-time services to the packages they load and writes CycloneDX SBOMs with services, dependencies, vulnerabilities and reachability-aware VEX.",
      "repository_url": "https://github.com/morpheuslord/Startup-SBOM",
      "website_url": "https://morpheuslord.github.io/Startup-SBOM/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "OUTDATED_COMPONENTS",
        "LICENSE_REPORTING",
        "POLICY_EVALUATION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL",
        "CPE"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "NODE.JS",
        "PYTHON",
        "RUST"
      ],
      "_fromFile": "startup_sbom.json"
    },
    {
      "name": "Sunshine",
      "publisher": "CycloneDX",
      "description": "Open-source SBOM visualization tool. Converts CycloneDX JSON into interactive charts and tables for components, dependencies, vulnerabilities, and licenses.",
      "website_url": "https://cyclonedx.github.io/Sunshine/",
      "repository_url": "https://github.com/CycloneDX/Sunshine/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "library": [
        "PYTHON"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedLanguages": [
        "PYTHON"
      ],
      "_fromFile": "sunshine.json"
    },
    {
      "name": "Surfactant",
      "publisher": "LLNL",
      "description": "A modular framework for extracting file information and relationships for filesystems, with an SBOM as the primary output.",
      "repository_url": "https://github.com/LLNL/Surfactant",
      "website_url": "https://github.com/LLNL/Surfactant",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "TRANSFORM"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "LIBRARY",
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.3"
      ],
      "supportedLanguages": [
        "C/C++",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "PYTHON"
      ],
      "_fromFile": "surfactant.json"
    },
    {
      "name": "Swarm Orchestrator",
      "publisher": "Brad Kinnard",
      "description": "Audits AI-generated pull requests for cheat patterns and emits CycloneDX-ML and SPDX 3.0 AI-Profile (AI-BOM) artifacts for EU AI Act and CISA SBOM-for-AI documentation.",
      "repository_url": "https://github.com/moonrunnerkc/swarm-orchestrator",
      "website_url": "https://github.com/moonrunnerkc/swarm-orchestrator#readme",
      "capabilities": [
        "AI/ML-BOM",
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "library": [
        "NODE.JS"
      ],
      "lifecycle": [
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "packaging": [
        "GITHUB_ACTION",
        "COMMAND_LINE_UTILITY"
      ],
      "_fromFile": "swarm_orchestrator.json"
    },
    {
      "name": "swift-package-sbom-generator",
      "publisher": "Mattt",
      "description": "A software bill of materials (SBOM) generator for Swift packages",
      "repository_url": "https://github.com/mattt/swift-package-sbom",
      "website_url": "https://github.com/mattt/swift-package-sbom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "SWIFT"
      ],
      "platform": [
        "MAC"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.2"
      ],
      "supportedLanguages": [
        "SWIFT"
      ],
      "_fromFile": "swift_package_sbom_generator.json"
    },
    {
      "name": "SwiftBOM",
      "publisher": "CERT Coordination Center (CERT/CC)",
      "description": "Generates SBOMs for demo and PoC purposes. Supports output in CycloneDX, SPDX, and SWID formats. Visualizes SBOMs as tree graphs.",
      "repository_url": "https://github.com/CERTCC/SBOM",
      "website_url": "https://sbom.democert.org/sbom/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "AUTHOR",
        "TRANSFORM"
      ],
      "analysis": [],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SWID"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.2"
      ],
      "supportedLanguages": [
        "JAVASCRIPT/TYPESCRIPT"
      ],
      "_fromFile": "swiftbom.json"
    },
    {
      "name": "Syft",
      "publisher": "Anchore",
      "description": "CLI tool and library for generating a Software Bill of Materials from container images and filesystems.",
      "repository_url": "https://github.com/anchore/syft",
      "website_url": "https://anchore.github.io/syft/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "RESOURCE_REPORTING",
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_SERIALIZATION_FORMAT",
        "BOM_STANDARD",
        "BOM_VERSION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "LIBRARY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.2",
        "CYCLONEDX_V1.3",
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST"
      ],
      "_fromFile": "syft.json"
    },
    {
      "name": "Tally",
      "publisher": "Jetstack",
      "description": "Command-line tool that adds OpenSSF Scorecard security posture scores to packages listed in CycloneDX SBOMs.",
      "repository_url": "https://github.com/jetstack/tally",
      "website_url": "https://github.com/jetstack/tally",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "POLICY_EVALUATION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "_fromFile": "tally.json"
    },
    {
      "name": "Technolinator",
      "publisher": "MediaMarktSaturn Technology",
      "description": "GitHub App that generates CycloneDX SBOMs with cdxgen, scans them for vulnerabilities using grype, and uploads results to Dependency-Track.",
      "repository_url": "https://github.com/MediaMarktSaturn/technolinator",
      "website_url": "https://github.com/MediaMarktSaturn/technolinator",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "packaging": [
        "GITHUB_APP",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "JAVA"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "_fromFile": "technolinator.json"
    },
    {
      "name": "TegmenSoft CRA Compliance Platform",
      "publisher": "TegmenSoft",
      "description": "EU Cyber Resilience Act platform for embedded device makers: SBOMs from firmware binaries, CycloneDX/SPDX import, KEV/EPSS vulnerability prioritisation, VEX and technical file.",
      "website_url": "https://www.tegmensoft.com.tr/en/platform",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "CPE",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [],
      "_fromFile": "tegmensoft_cra_platform.json"
    },
    {
      "name": "TegmenSoft SBOM Viewer",
      "publisher": "TegmenSoft",
      "description": "Free browser-based viewer for CycloneDX and SPDX JSON SBOMs. Lists components and known OSV vulnerabilities with severity and fixed versions; exports CycloneDX, SPDX or CSV.",
      "website_url": "https://www.tegmensoft.com.tr/en/sbom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "FREEMIUM"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_VERSION"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [],
      "_fromFile": "tegmensoft_sbom_viewer.json"
    },
    {
      "name": "Tern",
      "publisher": "Tern",
      "description": "Software composition analysis tool that generates a Software Bill of Materials for container images and Dockerfiles",
      "repository_url": "https://github.com/tern-tools/tern",
      "website_url": "https://github.com/tern-tools/tern",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "RESOURCE_REPORTING"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "_fromFile": "tern.json"
    },
    {
      "name": "Threat Detective",
      "publisher": "Threat Detective Ltd",
      "description": "FDA-ready SBOM compliance for medical devices. Validates CycloneDX and SPDX SBOMs against FDA requirements, enriches component data, flags known vulnerabilities, exports VEX, and generates eSTAR-ready premarket and postmarket documentation.",
      "website_url": "https://threatdetectivehq.com",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [],
      "packaging": [
        "APPLICATION"
      ],
      "library": [],
      "platform": [],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL",
        "CPE"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.7",
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [],
      "_fromFile": "threat_detective.json"
    },
    {
      "name": "ThreatMapper",
      "publisher": "Deepfence",
      "description": "Deepfence ThreatMapper hunts for vulnerabilities in production platforms, ranks vulnerabilities based on their risk-of-exploit using attack path enumeration, and generates CycloneDX SBOMs.",
      "repository_url": "https://github.com/deepfence/threatmapper",
      "website_url": "https://deepfence.io/threatmapper",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [],
      "packaging": [
        "CONTAINER_IMAGE",
        "APPLICATION",
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [],
      "_fromFile": "threatmapper.json"
    },
    {
      "name": "Threatrix",
      "publisher": "Threatrix",
      "description": "Threatrix CodeCertify platform provides a solution for producing a comprehensive and accurate, singular, CycloneDX bill of materials from multiple sources.",
      "website_url": "https://threatrix.io",
      "repository_url": "https://threatrix.io",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM",
        "DISTRIBUTE",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "GITHUB_APP",
        "GITHUB_ACTION",
        "COMMAND_LINE_UTILITY"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PERL",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SWIFT",
        "ERLANG_ELIXIR",
        "SCALA",
        "KOTLIN",
        "GROOVY",
        "FORTRAN",
        "NIM"
      ],
      "_fromFile": "threatrix.json"
    },
    {
      "name": "Tidelift",
      "publisher": "Tidelift",
      "description": "Tidelift provides a managed open-source subscription that delivers commercial support, maintenance, security and license assurances for the open-source dependencies used to build applications, backed directly by project maintainers.",
      "repository_url": "https://github.com/tidelift",
      "website_url": "https://tidelift.com/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY",
        "GITHUB_ACTION",
        "GITLAB_CI_TEMPLATE"
      ],
      "library": [],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "PYTHON",
        "SWIFT",
        "GO",
        "RUST",
        ".NET",
        "RUBY",
        "NODE.JS"
      ],
      "_fromFile": "tidelift.json"
    },
    {
      "name": "Trivy",
      "publisher": "Aqua Security",
      "description": "Comprehensive security scanner for containers, filesystems, Git repositories, VMs and Kubernetes that detects vulnerabilities, misconfigurations, secrets and generates CycloneDX SBOMs.",
      "repository_url": "https://github.com/aquasecurity/trivy",
      "website_url": "https://trivy.dev/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "POLICY_EVALUATION",
        "RESOURCE_REPORTING"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "DISCOVERY",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL",
        "CPE"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST"
      ],
      "_fromFile": "trivy.json"
    },
    {
      "name": "TrustSource",
      "publisher": "TrustSource",
      "description": "SaaS platform for implementing and maintaining open source compliance that imports CycloneDX SBOMs, analyzes them for licenses and vulnerabilities, and integrates with various development workflows.",
      "repository_url": "https://github.com/trustsource",
      "website_url": "https://www.trustsource.io/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "POLICY_EVALUATION",
        "RESOURCE_REPORTING"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT",
        "PYTHON",
        "JAVA"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "C/C++",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PYTHON",
        "RUBY"
      ],
      "_fromFile": "trustsource.json"
    },
    {
      "name": "ts-scan",
      "publisher": "TrustSource",
      "description": "Multi ecosystem SCA cli tool supporting SBOM generation, decoration and analysis for licenses, vulnerabilities, known code snippets and malware.",
      "repository_url": "https://github.com/TrustSource/ts-scan",
      "website_url": "https://trustsource.github.io/ts-scan/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "PYTHON",
        "C/C++",
        "GO",
        ".NET"
      ],
      "_fromFile": "ts_scan.json"
    },
    {
      "name": "Valaa Stack",
      "publisher": "Valaa Technologies",
      "description": "SBoMDoc is a VDoc extension which uses CycloneDX namespaces and can emit BOM documents in various formats",
      "repository_url": "https://github.com/valaatech/kernel",
      "website_url": "https://valospace.org/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "TRANSFORM"
      ],
      "analysis": [],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "LIBRARY"
      ],
      "library": [
        "JAVASCRIPT_TYPESCRIPT"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [
        "JAVASCRIPT/TYPESCRIPT"
      ],
      "_fromFile": "valaa_stack.json"
    },
    {
      "name": "Valint",
      "publisher": "Scribe Security",
      "description": "CLI and CI/CD tool for generating CycloneDX SBOMs, signing and verifying supply-chain evidence, enforcing policy, and tracking vulnerabilities across containers, source repositories, and pipelines.",
      "repository_url": "https://github.com/scribe-security/gatekeeper-valint",
      "website_url": "https://scribesecurity.com/scribe-platform-lp",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED",
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "SIGNING/NOTARY",
        "PACKAGE_MANAGER_INTEGRATION",
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION",
        "AZURE_PIPELINE_EXTENSION"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "_fromFile": "valint.json"
    },
    {
      "name": "Value Stream Management (VSM)",
      "publisher": "LeanIX",
      "description": "SaaS catalog that ingests CycloneDX SBOMs via REST API, indexes them by team and product, and surfaces vulnerabilities, licenses and component age to secure the software supply chain.",
      "website_url": "https://www.leanix.net/en/products/value-stream-management",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "SUBSCRIPTION",
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS",
        "POLICY_EVALUATION"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "_fromFile": "value_stream_management_vsm_.json"
    },
    {
      "name": "Veracode",
      "publisher": "Veracode",
      "description": "API to output SBOM in CycloneDX (JSON) format based on Veracode's software composition analysis (SCA) scan.",
      "website_url": "https://www.veracode.com/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [],
      "packaging": [
        "APPLICATION",
        "GITHUB_ACTION"
      ],
      "library": [],
      "platform": [
        "WINDOWS",
        "MAC",
        "LINUX"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "PYTHON",
        "RUBY",
        "GO",
        "PHP"
      ],
      "_fromFile": "veracode.json"
    },
    {
      "name": "vex2pdf",
      "publisher": "Salem B.",
      "description": "A Rust command-line tool and library to convert CycloneDX (VEX/VDR/SBOM) JSON or XML documents to PDF reports with support for vulnerability analysis visualization.",
      "repository_url": "https://gitlab.com/jurassicLizard/vex2pdf",
      "website_url": "https://crates.io/crates/vex2pdf",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "TRANSFORM"
      ],
      "analysis": [
        "RESOURCE_REPORTING",
        "SECURITY_VULNERABILITIES"
      ],
      "packaging": [
        "LIBRARY",
        "COMMAND_LINE_UTILITY",
        "APPLICATION"
      ],
      "library": [
        "RUST"
      ],
      "platform": [
        "LINUX",
        "WINDOWS",
        "MAC"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.6"
      ],
      "_fromFile": "vex2pdf.json"
    },
    {
      "name": "Vexy",
      "publisher": "Paul Horton",
      "description": "Generate VEX (Vulnerability Exploitability Exchange) CycloneDX documents.",
      "repository_url": "https://github.com/madpah/vexy",
      "website_url": "https://github.com/madpah/vexy",
      "capabilities": [
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [],
      "_fromFile": "vexy.json"
    },
    {
      "name": "Vigiles",
      "publisher": "Timesys",
      "description": "Vulnerability monitoring and remediation suite that imports, generates, converts, and analyses CycloneDX or SPDX SBOMs with curated CVE feeds and build-system integrations for Yocto, Buildroot, OpenWrt, and more.",
      "repository_url": "https://github.com/TimesysGit/vigiles-cli",
      "website_url": "https://www.timesys.com/solutions/vigiles-vulnerability-management/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "AUTHOR",
        "ANALYSIS",
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "transform": [
        "BOM_STANDARD"
      ],
      "packaging": [
        "APPLICATION",
        "COMMAND_LINE_UTILITY"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [],
      "_fromFile": "vigiles.json"
    },
    {
      "name": "vsm-sbom-booster",
      "publisher": "LeanIX",
      "description": "CLI and Docker-based tool that scans Git providers, runs ORT, generates CycloneDX SBOMs centrally, and uploads them to LeanIX VSM to speed onboarding.",
      "repository_url": "https://github.com/leanix/vsm-sbom-booster",
      "website_url": "https://github.com/leanix/vsm-sbom-booster",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "PACKAGE_MANAGER_INTEGRATION",
        "DISTRIBUTE"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "KOTLIN"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD",
        "POST-BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6"
      ],
      "supportedLanguages": [
        "C/C++",
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        ".NET",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "KOTLIN",
        "SCALA",
        "SWIFT"
      ],
      "_fromFile": "vsm_sbom_booster.json"
    },
    {
      "name": "Vulert Vulnerability Scanner",
      "publisher": "Vulert.com",
      "description": "Web SCA service that analyzes CycloneDX or SPDX SBOMs (or lockfiles) to flag open-source vulnerabilities and license issues, sending real-time alerts without requiring code access or signup.",
      "website_url": "https://vulert.com/abom",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "FREEMIUM"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX"
      ],
      "_fromFile": "vulert_vulnerability_scanner.json"
    },
    {
      "name": "VulnDex",
      "publisher": "VulnDex",
      "website_url": "https://VulnDex.at",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "LICENSE_REPORTING",
        "SECURITY_VULNERABILITIES"
      ],
      "supportedLanguages": [
        "JAVA",
        "NODE.JS",
        "PYTHON",
        "PHP"
      ],
      "description": "VulnDex turns CycloneDX SBOMs into operational vulnerability management. It continuously maps components to new CVEs, adds context, and assigns findings to responsible teams to improve prioritization and reduce manual effort.",
      "_fromFile": "vulndex.json"
    },
    {
      "name": "Vulnerabilities.io",
      "publisher": "Vulnerabilities Input Output Limited",
      "description": "Generates CycloneDX Software Bill of Materials (SBOM) and visualizations for an organization's codebase through integrations with source control systems. Enables organizations to manage overall supply chain risk.",
      "website_url": "https://www.vulnerabilities.io",
      "repository_url": "https://www.vulnerabilities.io",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "COMMERCIAL_LICENSE"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "packaging": [
        "GITHUB_APP",
        "COMMAND_LINE_UTILITY"
      ],
      "supportedLanguages": [
        "JAVA",
        ".NET",
        "PHP",
        "PYTHON",
        "JAVASCRIPT/TYPESCRIPT",
        "RUST",
        "ERLANG_ELIXIR"
      ],
      "_fromFile": "vulnerabilities_io.json"
    },
    {
      "name": "Vulnetix CLI",
      "publisher": "Vulnetix",
      "description": "A vulnerability scanner for SAST, IaC, container images, cloud, and SCA/licenses of software ecosystems. Works with all known package manager manifests and supports CycloneDX, SPDX, and OpenVEX.",
      "repository_url": "https://github.com/Vulnetix/cli",
      "website_url": "https://www.vulnetix.com/features/code-scanner",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "TRANSFORM"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT",
        "BOM_VERSION"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "GITHUB_ACTION"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD",
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "SPDX",
        "PACKAGE_URL",
        "CPE"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.7"
      ],
      "supportedLanguages": [
        "C/C++",
        ".NET",
        "ERLANG_ELIXIR",
        "GO",
        "GROOVY",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "KOTLIN",
        "NODE.JS",
        "PHP",
        "PYTHON",
        "RUBY",
        "RUST",
        "SCALA",
        "SWIFT"
      ],
      "_fromFile": "vulnetix_cli.json"
    },
    {
      "name": "Vuls",
      "publisher": "Future Corp",
      "description": "Agent-less vulnerability scanner for Linux, FreeBSD, containers, WordPress, programming language libraries and network devices which outputs CycloneDX Vulnerability Disclosure Reports (VDR).",
      "repository_url": "https://github.com/future-architect/vuls",
      "website_url": "https://vuls.io/",
      "capabilities": [
        "VDR/VEX"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "OPERATIONS",
        "DISCOVERY"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "_fromFile": "vuls.json"
    },
    {
      "name": "WpBom",
      "publisher": "Sepbit",
      "description": "WordPress plugin that generates CycloneDX SBOMs for installed plugins and themes, and can automatically submit them to OWASP Dependency-Track for vulnerability analysis.",
      "repository_url": "https://github.com/sepbit/wpbom",
      "website_url": "https://wordpress.org/plugins/wpbom/",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE"
      ],
      "functions": [
        "DISTRIBUTE",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [],
      "transform": [
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "APPLICATION"
      ],
      "library": [
        "PHP"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "PACKAGE_URL"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "PHP"
      ],
      "_fromFile": "wpbom.json"
    },
    {
      "name": "Xray",
      "publisher": "JFrog",
      "description": "JFrog Xray is a software-composition-analysis platform that finds vulnerabilities, license issues and policy violations in open-source and third-party components, and can export CycloneDX SBOMs with optional VEX data.",
      "website_url": "https://jfrog.com/xray/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "FREEMIUM",
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING"
      ],
      "transform": [
        "BOM_STANDARD",
        "BOM_SERIALIZATION_FORMAT"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION",
        "AZURE_PIPELINE_EXTENSION"
      ],
      "library": [
        "GO"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX",
        "CPE"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.5"
      ],
      "supportedLanguages": [
        "GO",
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "PYTHON",
        "C/C++",
        "PHP"
      ],
      "_fromFile": "xray.json"
    },
    {
      "name": "Xygeni Software Supply-Chain Security",
      "publisher": "Xygeni",
      "description": "Supply-chain security platform and CLI that generates CycloneDX SBOMs, analyses vulnerabilities and misconfigurations, enforces policy in CI/CD, and integrates with DevOps tools to secure releases.",
      "repository_url": "https://github.com/xygeni/xygeni-action",
      "website_url": "https://xygeni.io/",
      "capabilities": [
        "SBOM",
        "VDR/VEX"
      ],
      "availability": [
        "SUBSCRIPTION"
      ],
      "functions": [
        "ANALYSIS",
        "DISTRIBUTE",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "POLICY_EVALUATION",
        "LICENSE_REPORTING",
        "OUTDATED_COMPONENTS"
      ],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION",
        "JENKINS_PLUGIN"
      ],
      "library": [
        "JAVA"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "PRE-BUILD",
        "BUILD",
        "POST-BUILD",
        "OPERATIONS"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [
        "CYCLONEDX_V1.6",
        "CYCLONEDX_V1.5",
        "CYCLONEDX_V1.4"
      ],
      "supportedLanguages": [
        "JAVA",
        "JAVASCRIPT/TYPESCRIPT",
        "PYTHON",
        "GO",
        ".NET"
      ],
      "_fromFile": "xygeni_software_supply_chain_security.json"
    },
    {
      "name": "yasca (Yet Another SCA tool)",
      "publisher": "Javi",
      "description": "Yasca (Yet Another SCA tool) is an open-source Python utility and GitHub Action that scans Maven projects against GitHub Security Advisories, detects vulnerable or outdated dependencies, and exports CycloneDX SBOMs.",
      "repository_url": "https://github.com/javixeneize/zasca",
      "website_url": "https://github.com/javixeneize/zasca",
      "capabilities": [
        "SBOM"
      ],
      "availability": [
        "OPEN_SOURCE",
        "OSI_APPROVED"
      ],
      "functions": [
        "ANALYSIS",
        "PACKAGE_MANAGER_INTEGRATION"
      ],
      "analysis": [
        "SECURITY_VULNERABILITIES",
        "OUTDATED_COMPONENTS"
      ],
      "transform": [],
      "packaging": [
        "COMMAND_LINE_UTILITY",
        "CONTAINER_IMAGE",
        "GITHUB_ACTION"
      ],
      "library": [
        "PYTHON"
      ],
      "platform": [
        "LINUX",
        "MAC",
        "WINDOWS"
      ],
      "lifecycle": [
        "BUILD"
      ],
      "supportedStandards": [
        "CYCLONEDX"
      ],
      "cycloneDxVersion": [],
      "supportedLanguages": [
        "JAVA"
      ],
      "_fromFile": "yasca_yet_another_sca_tool_.json"
    }
  ]
}