# SBOM Explorer

> Open a CycloneDX or SPDX SBOM: components, licences, dependency tree and known vulnerabilities. Upload or paste a CycloneDX JSON or SPDX 2.x JSON software bill of materials. Lists every component with version, purl and type, classifies licences (permissive, weak / strong / network copyleft, unknown), draws the dependency tree when the SBOM records one, and checks every versioned purl against OSV.dev for known vulnerabilities.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://sbomexplorer.usefulweb.site/ (interactive tool at https://sbomexplorer.usefulweb.site/tool)
- JSON API: POST https://sbomexplorer.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://sbomexplorer.usefulweb.site/api/v1/tool)
- OpenAPI: https://sbomexplorer.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://sbomexplorer.usefulweb.site/mcp - tool `sbom_explorer`

## Inputs
- sbom (textarea): SBOM (CycloneDX or SPDX JSON)
- sbomFile (file): Or upload an SBOM file
- checkVulnerabilities (boolean): Check vulnerabilities on OSV.dev - Sends the component purls (not the SBOM) to api.osv.dev.

## Method
- CycloneDX: components (including nested ones), metadata.component as root and the dependencies graph. SPDX 2.x: packages, purls from externalRefs, licenseConcluded (else licenseDeclared) and DEPENDS_ON / *_DEPENDENCY_OF / CONTAINS relationships.
- Licences are classified from SPDX ids and expressions: for "A OR B" the more permissive option counts, for "A AND B" the more restrictive. NOASSERTION, missing and LicenseRef-* licences are reported as unknown. This flags review needs; it is not legal advice.
- Dependency depth is the shortest path from the root component (breadth-first); components not reachable from the root are listed as unattached.
- Vulnerabilities: every versioned purl (qualifiers stripped) is sent to the OSV.dev querybatch API; up to 50 advisories are expanded via /v1/vulns/{id} for severity and the nearest fixed version. Components without a purl cannot be checked.