Top 23 Python sbom Projects

sbom

• Add a project

1. scancode-toolkit

   1 7 2,564 9.3 Python

   :mag: ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet, the Google Summer of Code, Azure credits, nexB and other generous sponsors!

   

2. SaaSHub

   www.saashub.com featured

   SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

   

3. cve-bin-tool

   2 13 1,703 9.7 Python

   The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnerable components (openssl, libpng, libxml2, expat and others), or if you know the components used, you can get a list of known vulnerabilities associated with an SBOM or a list of components and versions.

   

4. dep-scan

   3 4 1,255 7.5 Python

   OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

   

   Project mention: Slopsquatting: AI Hallucinations as Supply Chain Attacks | dev.to | 2026-03-04

   Add a CI gate. Integrate Software Composition Analysis into your pipeline. Tools like OWASP dep-scan flag unknown or newly published packages before they reach production. Generate and sign Software Bills of Materials (SBOMs) for every build so each dependency is auditable. If a package does not appear in your organization's approved registry, the build should fail.

5. purl-spec

   4 14 1,056 9.4 Python

   A minimal specification for purl aka. a package "mostly universal" URL, join the discussion at https://gitter.im/package-url/Lobby

   

   Project mention: Reconciling 15 OSS Vulnerability Databases: What They Actually Cover | dev.to | 2026-04-09

   vuln_id is the primary identifier that source uses — a GHSA-xxxx, CVE-xxxx, PYSEC-xxxx, RUSTSEC-xxxx, GO-xxxx, or MAL-xxxx. aliases is a semicolon-joined list of cross-database identifiers the source knows about. purl is the Package URL — a canonical string like pkg:pypi/tensorflow or pkg:maven/io.grpc/grpc-protobuf that uniquely names a package across every public ecosystem.

6. tern

   5 2 1,017 3.2 Python

   Tern is a software composition analysis tool and Python library that generates a Software Bill of Materials for container images and Dockerfiles. The SBOM that Tern generates will give you a layer-by-layer view of what's inside your container in a variety of formats including human-readable, JSON, HTML, SPDX and more. (by tern-tools)

   

7. puncia

   6 3 663 6.2 Python

   Panthera(P.)uncia - Official CLI utility for Osprey Vision, Subdomain Center & Exploit Observer.

   

8. meta-package-manager

   7 13 598 9.5 Python

   🎁 wraps all package managers with a unifying CLI

   

9. reuse-tool

   8 15 578 9.5 Python

   This is a mirror of https://codeberg.org/fsfe/reuse-tool

   

   Project mention: REUSE – Making licensing easy for everyone | news.ycombinator.com | 2026-01-05

10. blint

    9 2 451 8.6 Python

    blint is a Binary Linter that checks the security properties and capabilities of your executables. It can also generate a Software Bill-of-Materials (SBOM) for supported binaries.

    

11. spdx-spec

    10 4 373 9.0 Python

    The System Package Data Exchange (SPDX) specification in Markdown and HTML formats.

    

12. sbomnix

    11 1 285 8.6 Python

    SBOM, provenance, dependency graph, and vulnerability tools for Nix.

    

13. ai-bom

    12 2 262 8.0 Python

    AI Bill of Materials — discover every AI agent, model, and API in your infrastructure

    

    Project mention: Show HN: AI-BOM – Open-source scanner that discovers shadow AI components | news.ycombinator.com | 2026-02-23

14. mcp-audit

    13 1 150 8.5 Python

    See what your AI agents can access. Scan MCP configs for exposed secrets, shadow APIs, and AI models. Generate AI-BOMs for compliance.

    

    Project mention: Show HN: APIsec MCP Audit – Audit what your AI agents can access | news.ycombinator.com | 2026-01-20

15. Veritensor

    14 2 80 9.8 Python

    The Anti-Virus for AI Artifacts & RAG Firewall. A static analysis tool scanning Models and Notebooks for RCE, Datasets and RAG docs for Data Poisoning, PII, and Prompt Injections. Secure your AI Supply Chain. (by arsbr)

    

    Project mention: Recomendation for open-source tool for the AI supply chain security | news.ycombinator.com | 2026-02-09

    https://github.com/arsbr/Veritensor

    The goal is to help teams secure the AI/ML supply chain as models, datasets, and tooling increasingly come from third parties.

    What it currently does:

16. vulnerability-scan-github-action-for-amazon-inspector

    15 1 57 4.3 Python

    Scan artifacts with Amazon Inspector from GitHub Actions workflows.

    

17. opentemplate

    16 1 42 7.3 Python

    All-in-one Python template. One click. Everything included.

    

18. Surfactant

    17 2 41 9.1 Python

    Modular framework for file information extraction and dependency analysis to generate accurate SBOMs

    

    Project mention: Show HN: Analyze binary capabilities in-browser with capa and Pyodide | news.ycombinator.com | 2026-01-21

    Hey all!

    I’ve been working on getting Mandiant’s capa (a tool for identifying capabilities in executables) to run entirely client-side in the browser using Pyodide.

    To make this happen, I’ve been working through the capa dependency tree to ensure all upstream packages publish an sdist or pure-Python wheels. We’ve finally reached the point where it’s possible to run capa to analyze binaries in a browser using the vivisect backend.

    The long-term goal is to upstream these changes to the official mandiant/capa repository. I’d love for people to try it out and let me know how the performance feels or if you run into any quirks.

    Again, a live version can be found here: https://surfactant.readthedocs.io/en/latest/capa/

    And the source files for the page is here: https://github.com/llnl/Surfactant/tree/main/docs/capa

    Suggestions and bug reports are welcome!

19. skillfortify

    18 3 26 7.6 Python

    First formal security scanner for AI agent skills & plugins. Static analysis, supply chain verification, SBOM generation. 22 frameworks supported including MCP, LangChain, CrewAI.

    

    Project mention: AI Agents Need an Iron Dome Before They Get an Iron Man | dev.to | 2026-04-26

    This is exactly what frameworks like SkillFortify do — automated verification of AI agent skills against 22 security frameworks before they're allowed to execute. The OpenClaw crisis would have been caught at installation time, not after 341 skills were already deployed.

20. bogrod

    19 3 22 6.6 Python

    Manage SBOM and VEX like source code

    

21. gitgalaxy

    20 2 15 - Python

    An AST-free, LLM-free heuristic knowledge graph engine for deep repository intelligence. Map, secure, and modernize enterprise codebases across 50+ languages at extreme velocity

    

    Project mention: BlAST Engine: AST-free static analyzer to auto-generate agents.md in the CI pipe | news.ycombinator.com | 2026-04-29

22. Izumi

    21 1 2 8.4 Python

    LLM-powered OSS detection and SBOM generation for C/C++ codebases (by moonkick64)

    

    Project mention: Izumi: An LLM-Powered SBOM Generator Built Out of Frustration | dev.to | 2026-04-01

    The result is Izumi — an SBOM tool that combines LLM-based OSS detection with static analysis for license identification directly from source code. If you're working on embedded software or C/C++ projects and struggling with SBOM compliance, I'd love to hear your thoughts. The project is open source — [https://github.com/moonkick64/Izumi].

23. software-supply-chain

    22 1 0 3.3 Python

    Compilation of articles and utils about Software Supply Chain Security

    

    Project mention: Using SBOMs to detect possible Dependency Confusion | dev.to | 2025-08-15

    This combined approach ensures repeatable, scalable, and CI-integrated detection. The fully automated solution is available in the dedicated GitHub repository.

24. threat-intel-api

    23 1 0 - Python

    Sector-aware OSINT vulnerability intelligence API. Aggregates NVD, CISA KEV and GitHub Advisories, scores each CVE per industry profile. (by Setounkpe7)

    

    Project mention: Sector-aware threat intel API: stop triaging hundreds of CVEs manually | dev.to | 2026-05-18

    threat-intel-api is an open-source (MIT) vulnerability intelligence service. It pulls in NVD, CISA KEV and GHSA, removes the duplicates between them, and scores every CVE against a YAML file you write that describes what your sector and your stack actually care about.

Python sbom related posts

• Top 10 SBOM Tools to Inventory Your App Components

  3 projects | dev.to | 15 Oct 2024

• Show HN: Manage SBOMs like source code

  1 project | news.ycombinator.com | 7 Sep 2024

• bomber - a vulnerability scanner for SBOMs

  2 projects | /r/netsec | 23 Aug 2022

• Learn by reading code: Python standard library design decisions explained

  4 projects | news.ycombinator.com | 30 Jun 2021

Index

Sponsored

SaaSHub - Software Alternatives and Reviews

SaaSHub helps you find the best software and product alternatives

www.saashub.com

Do not miss the trending Python projects with our weekly report!