SBOM Explorer

Open a CycloneDX or SPDX SBOM: components, licences, dependency tree and known vulnerabilities.

Try an example: CycloneDX app SBOM, licences + tree only (offline) · SPDX 2.3 Python service (offline) · CycloneDX with OSV vulnerability check

How it works

Upload or paste a CycloneDX JSON or SPDX 2.x JSON software bill of materials. Lists every component with version, purl and type, classifies licences (permissive, weak / strong / network copyleft, unknown), draws the dependency tree when the SBOM records one, and checks every versioned purl against OSV.dev for known vulnerabilities.

CycloneDX: components (including nested ones), metadata.component as root and the dependencies graph. SPDX 2.x: packages, purls from externalRefs, licenseConcluded (else licenseDeclared) and DEPENDS_ON / *_DEPENDENCY_OF / CONTAINS relationships.
Licences are classified from SPDX ids and expressions: for "A OR B" the more permissive option counts, for "A AND B" the more restrictive. NOASSERTION, missing and LicenseRef-* licences are reported as unknown. This flags review needs; it is not legal advice.
Dependency depth is the shortest path from the root component (breadth-first); components not reachable from the root are listed as unattached.
Vulnerabilities: every versioned purl (qualifiers stripped) is sent to the OSV.dev querybatch API; up to 50 advisories are expanded via /v1/vulns/{id} for severity and the nearest fixed version. Components without a purl cannot be checked.

For scripts and AI agents

JSON API: POST https://sbomexplorer.usefulweb.site/api/v1/calculate (same calculation as this page)
Interface description: OpenAPI 3.1 · AI guide: llms.txt
MCP server (Streamable HTTP): https://sbomexplorer.usefulweb.site/mcp · tool name sbom_explorer

Example request

curl -s -X POST https://sbomexplorer.usefulweb.site/api/v1/calculate \
  -H 'content-type: application/json' \
  -d '{…see OpenAPI examples…}'

Related tools

Dependency Vulnerability Explorer – Known vulnerabilities in your dependencies, and the version that fixes each one.
CVE Relationship Graph – One CVE or GHSA as a graph: aliases, affected packages, fixed versions, KEV status and EPSS.
Container Image Explorer – Inspect a container image: platforms, layers, base image, root user, labels and cosign signature.