[opensourcedex]

cdxgen is a free, open source erp & operations project written in JavaScript and released under Apache-2.0. It has 1,073 GitHub stars, 261 forks and 420 open issues, and was last pushed yesterday. On this registry it ranks #12 of 25 tracked projects in ERP & Operations, with 5 head-to-head comparisons available. It gained 3 stars over the last 3 tracked days.

What is cdxgen?

cdxgen is a CLI tool, library, REPL, and server that creates, validates, signs, and verifies CycloneDX Bill of Materials documents from source code and container images, and it is aimed at developers, AppSec engineers, compliance teams, and platform teams that need machine-readable BOMs inside a CI/CD pipeline.

What it is

cdxgen is a CycloneDX generator built as a JavaScript project and released under the Apache-2.0 licence. It runs in four shapes: a command-line tool, a library for embedding in other programs, an interactive REPL, and a server. Its native output is CycloneDX JSON, and it can also export SPDX 3.0.1 JSON-LD. The tool targets CycloneDX specification versions 1.6, 1.7, and 2.0, and the resulting document can be downgraded to 1.4 or 1.5 when a legacy consumer cannot read the newer versions.

The concrete problem it solves is that a build or runtime environment rarely exposes an accurate inventory of what it actually contains. cdxgen inspects a project, a git URL, a package-url, a container image, or a live host, and turns that inspection into a structured BOM that downstream security and compliance tooling can parse. It replaces the hand-maintained or absent component list that teams otherwise assemble for software composition analysis, and it lives in the CycloneDX and OWASP ecosystem, covering software, hardware, operations, cryptography, SaaS, and AI/ML inventories rather than only application dependencies.

Key capabilities

  • Generates CycloneDX JSON BOMs targeting spec versions 1.6, 1.7, and 2.0, with downgrade support for 1.4 and 1.5.
  • Builds SBOMs for many languages and container images, HBOMs for live hosts such as Apple Silicon macOS and Linux amd64/arm64 systems, and OBOMs for Linux container images and Linux or Windows VMs.
  • Produces CBOMs for Java keystores and certificates, plus source-level algorithm inventory for JavaScript and TypeScript.
  • Emits SaaSBOMs for Java, Python, JavaScript, TypeScript, and PHP projects, and AI-BOMs for prompt files, AI services, MCP configs, and model metadata.
  • Exports SPDX 3.0.1 JSON-LD through cdxgen --format spdx or cdx-convert.
  • Validates BOM quality and SCVS/CRA posture with cdx-validate -i bom.json --benchmark scvs-l2,cra.
  • Grades capture completeness with cdxgen --profile introspect --introspect-fail-below 70 -o bom.json ., and enriches BOMs with --profile appsec --evidence --bom-audit.

Who uses it and how

  • Developers generate a BOM from a local repository, git URL, purl, or container image with cdxgen -o bom.json ..
  • CI/CD pipelines run cdxgen and submit results automatically to a Dependency Track server.
  • AppSec teams enrich a BOM with evidence and run BOM audit rules using cdxgen -o bom.json --profile appsec --evidence --bom-audit ..
  • SOC analysts build host inventories with obom -o obom.json --deep --bom-audit --bom-audit-categories obom-runtime and triage runtime posture.
  • AI platform teams run aibom ., hardware teams run hbom -o hbom.json, and compliance teams check SCVS and CRA posture before exporting SPDX deliverables.

Getting started

The project is distributed through npm and JSR, with releases published on GitHub. A first BOM from a local repository takes one command: cdxgen -o bom.json .

How it compares

No list of paid products that cdxgen replaces is given in the available facts, so the comparison stays within its own ecosystem. cdxgen sits alongside OWASP tooling and is designed to pair with OWASP depscan, which automates Vulnerability Disclosure Report generation at scale from cdxgen output.

When to use it — and when not to

A self-hoster who wants automatic submission must operate a Dependency Track server in addition to running cdxgen, and the server mode adds another service to maintain. Teams whose scope is a single language and a single document format may find the breadth of HBOM, OBOM, CBOM, SaaSBOM, and AI-BOM support larger than their need. The project shows 420 open issues, so prospective adopters should expect an active but substantial backlog, and the repository metadata alone does not establish how quickly any individual issue will be resolved.

project readme (upstream, from github) — read inline

SBOM AI-DECLARATION: pair [![JSR][badge-jsr]][jsr-cdxgen] [![NPM][badge-npm]][npmjs-cdxgen] [![GitHub Releases][badge-github-releases]][github-releases] [![NPM Downloads][badge-npm-downloads]][npmjs-cdxgen] [![GitHub License][badge-github-license]][github-license] [![GitHub Contributors][badge-github-contributors]][github-contributors] [![SWH][badge-swh]][swh-cdxgen]

CycloneDX Generator (cdxgen)

cdxgen is a CLI tool, library, REPL, and server to create, validate, sign, and verify software BOMs. It generates CycloneDX JSON BOMs and supports SPDX 3.0.1 JSON-LD export. CycloneDX is a full-stack BOM specification that is easily created, human and machine-readable, and simple to parse. The tool generates BOMs targeting CycloneDX specification versions 1.6, 1.7, and 2.0, and the output can be downgraded to 1.4 or 1.5 for legacy consumers.

Supported BOM formats:

  • Hardware (HBOM) - For supported live hosts such as Apple Silicon macOS and Linux amd64/arm64 systems.
  • Software (SBOM) - For many languages and container images.
  • Cryptography (CBOM) - For Java keystores and certificates, plus JavaScript and TypeScript source-level algorithm inventory.
  • Operations (OBOM) - For Linux container images and VMs running Linux or Windows operating systems.
  • Software-as-a-Service (SaaSBOM) - For Java, Python, JavaScript, TypeScript, and PHP projects.
  • AI/ML (AI-BOM) - For prompt files, AI services, MCP configs, and model metadata with explainable AI-governance, security, performance, and agentic findings.
  • Attestations (CDXA) - Generate SBOM with templates for multiple standards. Sign the BOM document at a granular level to improve authenticity.
  • Vulnerability Disclosure Report (VDR) - Use cdxgen with OWASP depscan to automate the generation of VDR at scale.

Supported output document formats:

  • CycloneDX JSON (primary native format)
  • SPDX 3.0.1 JSON-LD (cdxgen --format spdx or cdx-convert)

Choose your path

Persona What cdxgen helps you do First command Read next
Developers Generate a CycloneDX BOM from a local repo, git URL, purl, or container image cdxgen -o bom.json . [CLI Usage][docs-cli], [Supported Project Types][docs-project-types]
AI platform teams Generate AI/ML BOMs, catalog prompt/model/MCP surfaces, and run AI-BOM governance aibom . AI-BOM Guide, AI-BOM lesson
Hardware teams Generate an HBOM or merged HBOM+OBOM host view for the current host hbom -o hbom.json HBOM guide, HBOM lesson
AppSec Enrich BOMs with evidence, run BOM audit rules, and feed downstream security workflows cdxgen -o bom.json --profile appsec --evidence --bom-audit . BOM Audit, Threat Model
Build engineers Grade how completely the SBOM captured the project, and get ranked fixes when the build environment degraded it cdxgen --profile introspect --introspect-fail-below 70 -o bom.json . Build Introspection, Fidelity loop skill
SOC analysts Build OBOM inventories for live hosts and triage runtime posture issues obom -o obom.json --deep --bom-audit --bom-audit-categories obom-runtime OBOM lessons, [Server Usage][docs-server]
Compliance teams Validate BOM quality, check SCVS/CRA posture, and export SPDX deliverables cdx-validate -i bom.json --benchmark scvs-l2,cra cdx-validate, cdx-convert, [Permissions][docs-permissions]
Security Teams Dynamically trace executions to capture cryptographic activities, CBOM properties, software components, and services tracebom --cbom-output cbom.json -- npm test Threat Model

Role-based quick starts

For developers
  • Start with a local path, git URL, or purl and generate a BOM in one command.
  • Use [Supported Project Types][docs-project-types] to confirm ecosystem coverage before wiring cdxgen into CI.
For hardware and platform teams
  • Use hbom when you need a CycloneDX hardware inventory for the current host rather than a software dependency graph.
  • Start with the HBOM guide and the HBOM lesson for supported platforms, enrichment options, and validation workflows.
  • Use hbom --dry-run first when you want a read-only partial HBOM plus an exact list of blocked hardware probe commands before a full collection run.
  • Use hbom diagnostics when you want a focused summary of missing native utilities and permission-denied enrichments before deciding whether to install host packages or rerun with --privileged.
  • Use hbom --include-runtime when you want one topology-aware CycloneDX host document that merges hardware inventory with runtime evidence using strict, non-guessing joins.
For AppSec
  • Use --profile appsec, --evidence, and --bom-audit when you want richer security context.
  • Combine generation with BOM Audit, cdx-validate, signing, and verification for a fuller secure-SBOM workflow.
  • Use tracebom to dynamically profile applications & services and capture negotiated TLS cipher suites, protocols, cryptographic libraries, dynamically resolved software components, and services in CycloneDX 1.7 format.
For AI platform and governance teams
  • Use --include-formulation plus --bom-audit --bom-audit-categories ai-bom when you want one AI-BOM workflow for prompt files, AI services, MCP configs, and model metadata.
  • Use aibom when you want the same defaults in one dedicated CLI, including direct Hugging Face purls/URLs and direct Modelfile / .gguf inputs.
  • Start with the AI-BOM Guide and the AI-BOM lesson for the preferred alias, review flow, and category breakdown.
For SOC analysts
  • Use obom for live-system and runtime inventory on Linux, Windows, and macOS hosts.
  • Focus on OBOM lessons when you need host triage, persistence review, Linux GTFOBins-backed runtime analysis, hardening drift review, or incident-response evidence.
For compliance and platform governance
  • Use cdx-validate to assess structural and compliance posture, then cdx-convert when SPDX output is required.
  • Review [Permissions][docs-permissions] and hardened-environment guidance before adopting cdxgen in controlled pipelines.

Why cdxgen?

Most SBOM tools are like simple barcode scanners. For easy applications, they can parse a few package manifests and create a list of components only based on these files without any deep inspection. Further, a typical application might have several repos, components, and libraries with complex build requirements. Traditional techniques to generate an SBOM per language or package manifest either do not work in enterprise environments or don't provide the confidence required for both compliance and automated analysis. So we built cdxgen - the universal polyglot SBOM generator that is user-friendly, precise, and comprehensive!

**Our philosoph

readme truncated — read the full docs on github

Frequently asked questions

Is cdxgen free to use?

cdxgen is open source under the Apache-2.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does cdxgen do?

Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI

What is cdxgen written in?

cdxgen is primarily written in JavaScript. Its source is publicly available at https://github.com/cdxgen/cdxgen, and it has 1,073 GitHub stars.