Feature · SBOM

A CycloneDX or SPDX SBOM, without adding anything to your CI.

LibWatch already knows every dependency of your projects. It turns them into a machine-readable software bill of materials, validated against the official schemas, ready to download in one click.

Generate an SBOM
Read with an AI .md version
orders-api-cyclonedx-sbom.json 
{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "components": [
    {
      "type": "library",
      "name": "symfony/http-kernel",
      "version": "6.4.1",
      "purl": "pkg:composer/symfony/http-kernel@6.4.1"
    }
  ]
}

Two formats

CycloneDX for security, SPDX for licenses

JSON

CycloneDX 1.5

— The format most requested by security tools.

— Can be imported into OWASP Dependency-Track.

— Name, version, registry and purl identifier of each component.

JSON

SPDX 2.3

— The Linux Foundation standard, focused on licenses.

— Useful for open source compliance.

— The same components, in a different structure.

In practice

From analysis to file

The SBOM always follows the project's latest analysis.

Open the project

The SBOM uses its latest completed analysis, or a specific analysis.

Choose the format

CycloneDX or SPDX, in JSON.

Download it, or query it over MCP

The SBOM summary is also available to your AI assistants.

Other exports

For your clients and your audits

PDF

Printable report

One page per project, to save as a PDF for a report.

CSV and JSON

Raw data

For your spreadsheets and scripts.

Link

Public sharing

The project's score and its trend, no account needed.

Frequently asked questions

About SBOMs

Does the SBOM cover transitive dependencies?
It includes everything the lockfile describes. With a lockfile, transitive dependencies are included.
Is the SBOM enough for the CRA?
No, not on its own. The CRA requires a machine-readable SBOM, which CycloneDX and SPDX are, but also vulnerability handling and technical documentation, of which the SBOM is only one part. See what the CRA and NIS2 require.
Can I import it into Dependency-Track?
Yes. The CycloneDX 1.5 JSON file imports into OWASP Dependency-Track like any CycloneDX SBOM.

Your SBOM is waiting for you after the first analysis.

Try it for 14 days