Turn SBOMs into
supply-chain decisions

The local-first Rust CLI for SBOM, CBOM, and AI BOM intelligence.
Diff CycloneDX & SPDX, catch OSV and KEV vulnerabilities, and prove compliance with NTIA, CRA, and PQC — in seconds, right inside your CI.

brew install sbom-tool/tap/sbom-tools

View on GitHub Docs Changelog Follow

—GitHub stars

—Crates.io downloads

MITOpen source

Works where you already operate

Everything you need to analyze your software supply chain.

Analysis

Semantic Diffing

Component-level change detection with version diffs, vulnerability tracking, and license delta analysis.

$ sbom-tools diff a.json b.json

+ pkg:npm/zod@3.23.8

- pkg:npm/body-parser@1.20.2

~ lodash 4.17.20 → 4.17.21

Security

Vulnerability & EOL Enrichment

OSV/KEV vulnerability tracking, end-of-life detection, and typosquat flagging.

✗ CVE-2024-29041 (HIGH)

express <4.19.2 — resolved

⚠ EOL: python 2.7 (2020-01-01)

⚠ Typosquat: lod-ash → lodash?

Compatibility

Multi-Format Support

CycloneDX (1.4–1.6) and SPDX (2.2–2.3) in JSON, XML, tag-value, and RDF/XML.

CycloneDX 1.6SPDX 2.3JSON / XMLTag-Value

Compliance

Quality & Compliance

Score SBOMs against NTIA, FDA, CRA, NIST SSDF, and EO 14028 standards with 6 scoring profiles.

NTIA

92%

CRA

85%

SSDF

71%

Analysis

Fuzzy Matching

Multi-tier matching with PURL, alias lookup, ecosystem normalization, and string similarity.

matching…

✓ PURL exact → 89 matched

~ Fuzzy → 12 resolved

? Unmatched → 3 remaining

Output

Multiple Outputs

JSON, SARIF, HTML, Markdown, CSV, table, side-by-side, summary, and interactive TUI.

JSONSARIFHTMLMarkdownCSVTableTUI

See it in action

A full TUI for diffing, viewing, and scoring your SBOMs — right in the terminal.

Diff Summary

Pipeline

How It Works

Three steps to full supply chain visibility.

Step 01

Input

CycloneDX or SPDX files

Point at two SBOMs — any supported format, any version.

JSONXMLSPDX TVRDF

Step 02

Analyze & Diff

Semantic comparison engine

Component-level matching, then OSV and KEV enrichment.

Fuzzy MatchVuln EnrichGraph DiffScoring

Step 03

Report

Actionable output formats

Gate the build, open a PR comment, or browse in the terminal.

JSONSARIFHTMLTUI

Quick Start

Get up and running in seconds.

# Compare two SBOMs

$ sbom-tools diff old.json new.json --enrich-vulns

# View interactively

$ sbom-tools view sbom.json

# Validate compliance

$ sbom-tools validate sbom.json --standard ntia,cra

# Assess quality

$ sbom-tools quality sbom.json --profile security --recommendations

# Score CBOM crypto health

$ sbom-tools quality cbom.json --profile cbom

# View CBOM inventory

$ sbom-tools view cbom.json --bom-type cbom

# Search across SBOMs

$ sbom-tools query "log4j" --version "<2.17.0" fleet/*.json

# Fleet comparison

$ sbom-tools diff-multi baseline.json target1.json target2.json

# Shell completions

$ sbom-tools completions bash > ~/.local/share/bash-completion/completions/sbom-tools

Example diff output:

SBOM Diff: old-sbom.json → new-sbom.json

Components: 142 → 145 (+5 added, -2 removed, ~3 modified)

 + pkg:npm/express@4.19.2           (added)
 + pkg:npm/zod@3.23.8               (added)
 - pkg:npm/body-parser@1.20.2       (removed)
 ~ pkg:npm/lodash@4.17.20 → 4.17.21  (version bump)
 ~ pkg:npm/axios@1.6.0 → 1.7.4       (version bump)

Vulnerabilities:
 ✗ CVE-2024-29041 (HIGH) — express <4.19.2  [resolved]
 ✗ CVE-2024-4068  (HIGH) — braces <3.0.3    [new]

License changes: none

Query & Fleet

Search across SBOMs and compare entire portfolios.

Find vulnerable components across your entire SBOM fleet

$ sbom-tools query "log4j" --version "<2.17.0" fleet/*.cdx.json

Query: "log4j" AND version=<2.17.0 across 5 SBOMs (1247 total components)

COMPONENT  VERSION  ECOSYSTEM  LICENSE     VULNS  FOUND IN
log4j      2.14.0   maven      Apache-2.0      1  firmware-v1, device-a
log4j      2.14.1   maven      Apache-2.0      1  gateway

2 components found across 5 SBOMs

--name--version--ecosystem--license--purl--supplier--affected-by--enrich-vulns

CI/CD Integration

Gate deployments on SBOM changes, vulnerabilities, or quality regressions.

sbom-tool/sbom-tools-action

Official GitHub Action — diff, validate, and gate SBOMs directly in your workflows. View on Marketplace

.github/workflows/sbom-check.yml

name: SBOM Check
on:
  pull_request:
    paths: ['sbom.json']

jobs:
  sbom-diff:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2

      - name: Get previous SBOM
        run: git show HEAD~1:sbom.json > /tmp/old-sbom.json

      - name: Diff SBOM
        uses: sbom-tool/sbom-tools-action@v1
        with:
          command: diff
          args: /tmp/old-sbom.json sbom.json
          fail-on-vuln: true
          enrich-vulns: true
          output-format: sarif
          output-file: results.sarif

      - name: Upload SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif

Exit Codes

0Success

1Changes detected (--fail-on-change)

2New vulnerabilities (--fail-on-vuln)

3Error

4VEX coverage gaps (--fail-on-vex-gap)

Supply Chain Trust

We practice what we preach — every release is transparent, attested, and signed.

Sigstore Signing

Keyless signatures on all release archives — verify authenticity without managing keys.

View Releases

Build Attestations

GitHub build attestations provide per-binary cryptographic proof of provenance.

View Attestations

Dual-Format SBOMs

CycloneDX 1.6 + SPDX 2.3 SBOMs included in every release asset.

Download & Verify

SLSA Provenance Deterministic Builds Sigstore Keyless GitHub Attestations

Every release is built in GitHub Actions with provenance attestations and keyless Sigstore signatures. How to verify a release →

Turn SBOMs into supply-chain decisions