Analysis & detection

What is SBOM Generation?

Producing a machine-readable inventory of everything in a build, usually in CycloneDX or SPDX format.

A Software Bill of Materials lists every component and version in a piece of software so that, when the next widely-exploited dependency vulnerability lands, an organisation can answer 'are we affected' in minutes rather than weeks.

SBOMs have moved from good practice to procurement requirement in regulated sectors and government supply chains, which is why this capability is very often gated behind enterprise plans.

Top 11 SBOM Generation tools

Every tool in the directory documented as supporting SBOM Generation, 10 fully, 1 partially, with what its own documentation says.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

  1. 1
    CodacyQuality PlatformBusiness

    SBOM exports available as a compliance feature; Business plan only.

  2. 2
    AikidoCode Security PlatformBasic

    Exports full SBOM (CycloneDX, SPDX, CSV) from Licenses & SBOM report

  3. 3
    Checkmarx OneCode Security Platform

    CycloneDX (v1.3–v1.7 depending on surface) and SPDX v2.3, XML or JSON; can also scan an existing SBOM.

  4. 4
    CodeAnt AIPR Review

    Software Bill of Materials generation and analysis

  5. 5
    CodeRabbitPR Reviewadd-on

    Generates SBOM as a dedicated scan type; requires Security trial or paid add-on.

  6. 6
    CorgeaCode Security Platform

    corgea deps sbom produces a CycloneDX SBOM

  7. 7
    GitHub Advanced SecurityCode Security PlatformFree (all plans)

    SPDX-compatible SBOM export from the dependency graph via UI or REST API; linkable to artifact attestations

  8. 8
    SemgrepCode Security Platform

    Per-repository CycloneDX 1.4, 1.5, 1.6, 1.7 SBOMs in JSON and XML via UI or API.

  9. 9
    SonarQubeQuality Platformadd-on

    SBOM export in standard formats is part of the separately subscribed SCA product.

  10. 10
    VeracodeCode Security Platformadd-on

    REST API and 'veracode sbom' CLI output CycloneDX 1.6, SPDX 2.3, Syft JSON; unbuilt Gradle limited

  11. 11
    SnykCode Security PlatformPartial

    Org-wide BOM view exportable to CSV and AI-BOM generation; CLI `snyk sbom test` consumes SBOMs.

What to look for

  • Which formats are supported, since CycloneDX and SPDX are the two that matter
  • Whether SBOMs can be generated per build and stored historically
  • Signing and attestation support, if you need supply-chain provenance
  • Whether an existing SBOM can be imported and scanned

Related terms

SASTTaint / Data-Flow AnalysisSecrets DetectionSecrets ValidationSCA (Software Composition Analysis)Reachability Analysis

FAQ

What is SBOM Generation?

Producing a machine-readable inventory of everything in a build, usually in CycloneDX or SPDX format.

How many tools support SBOM Generation?

11 of the 20 tools tracked in this directory support SBOM Generation, 10 fully and 1 partially, including Codacy, Aikido, Checkmarx One, CodeAnt AI, CodeRabbit. Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

What should you look for in SBOM Generation?

Which formats are supported, since CycloneDX and SPDX are the two that matter. Whether SBOMs can be generated per build and stored historically. Signing and attestation support, if you need supply-chain provenance. Whether an existing SBOM can be imported and scanned.