Software bill of materials

An SBOM with every analysis

Every analysis lists every package your lockfiles install, with its licence, what pulls it in and its known vulnerabilities. Download it as a CycloneDX 1.6 SBOM, on every plan, the free one too.

What's in it

One document per analysis, built from the same data as the report, so the SBOM and the score always describe the same commit.

  • Every installed package

    Each npm and Composer package version your lockfiles install, with its package URL (purl), whether you declare it yourself or it comes in through another package, and whether only development needs it.

  • Licences

    The licence of each package as an SPDX id or SPDX expression. Lockfiles that don't record licences (yarn, pnpm, bun) get them from the npm registry; a value that isn't SPDX is kept as the licence's name.

  • The dependency graph

    Which package pulls in which, from your project down, so you can see why a package is there.

  • Known vulnerabilities

    The advisories OSV knows for these versions, linked to the packages they affect, with a severity and the version that fixes them.

Read from your lockfiles

Agnes builds the list from the lockfile, outside the sandbox. It never installs your dependencies or runs your code.

  • package-lock.json
  • npm-shrinkwrap.json
  • yarn.lock
  • pnpm-lock.yaml
  • bun.lock
  • composer.lock

No lockfile, no SBOM: commit one so every analysis can list what you ship. Composer packages are listed with their licences and advisories.

One package in the SBOM
{
  "type": "library",
  "bom-ref": "pkg:npm/%40vue/reactivity@3.5.13",
  "group": "@vue",
  "name": "reactivity",
  "version": "3.5.13",
  "purl": "pkg:npm/%40vue/reactivity@3.5.13",
  "scope": "required",
  "licenses": [{ "license": { "id": "MIT" } }],
  "properties": [
    { "name": "agnes:direct", "value": "false" },
    { "name": "agnes:lockfile", "value": "package-lock.json" }
  ]
}

Where to get it

The SBOM of the latest analysis is always one click away, and older analyses keep theirs.

  • Project overview

    The SBOM card on a project's overview downloads the latest one, with the number of packages, licences and vulnerabilities in it.

  • Any analysis

    Each analysis has its own download, so you can hand over the SBOM of exactly the commit you shipped.

  • Your AI agent

    Agents connected to Agnes fetch it with the get_sbom tool, for example to check a licence or plan an upgrade.

    Connect an agent →

For customers, audits and the Cyber Resilience Act

Customers and auditors increasingly ask for an SBOM, and the EU's Cyber Resilience Act asks makers of products with digital elements to draw one up, covering at least the top-level dependencies. Agnes's SBOM covers every installed package and stays current with every analysis. It is one part of what the act asks for, not compliance on its own.

The format

CycloneDX 1.6 JSON, the OWASP standard most SBOM tools read. Packages are identified by package URL and licences by SPDX, and our tests check the export against the official CycloneDX schema. The document's serial number is the analysis's id, so the same analysis always gives the same SBOM.

Not in it: your own source files, file hashes, and packages that aren't in a lockfile, such as vendored scripts. Very large projects stop at 20,000 packages; the SBOM then says how many it left out.

See what your repository ships

Connect a repository and the first analysis comes with its SBOM.

Get started