Skip to content
@CycloneDX

CycloneDX BOM Standard

CycloneDX is a modern standard for the software supply chain. SBOM, SaaSBOM, CBOM, OBOM, VEX, and more. CycloneDX is a OWASP project ratified as ECMA-424

Welcome to the CycloneDX Community

CycloneDX logo

OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. The specification supports:

  • Software Bill of Materials (SBOM)
  • Software-as-a-Service Bill of Materials (SaaSBOM)
  • Hardware Bill of Materials (HBOM)
  • Machine Learning Bill of Materials (ML-BOM)
  • Cryptography Bill of Materials (CBOM)
  • Manufacturing Bill of Materials (MBOM)
  • Operations Bill of Materials (OBOM)
  • Vulnerability Disclosure Reports (VDR)
  • Vulnerability Exploitability eXchange (VEX)
  • CycloneDX Attestations (CDXA)

The CycloneDX project provides standards in XML, JSON, and Protocol Buffers, as well as a large collection of official and community supported tools that create or interoperate with the standard.

The project's website has many documented use cases and examples that provide a springboard to SBOM adoption.

The project operates as a meritocracy whose guiding principles reinforce its risk-based approach to standards development. The project encourages community participation in the development of the standard and supporting tools.

Background

Modern software is assembled using third-party and open source components. They are glued together in complex and unique ways and integrated with original code to achieve the desired functionality. An accurate inventory of all components enables organizations to identify risk, allows for greater transparency, and enables rapid impact analysis.

CycloneDX was created for this purpose.

Strategic direction and maintenance of the specification is managed by the CycloneDX Core Working Group, is backed by the OWASP Foundation, and is supported by the global information security community.

Pinned Loading

  1. specification specification Public

    OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. SBOM, SaaSBOM, HBOM, AI/ML-BOM, CBOM, OBOM, MBOM, VDR, an…

    XSLT 390 67

  2. cyclonedx-python cyclonedx-python Public

    CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments

    Python 277 72

  3. cyclonedx-maven-plugin cyclonedx-maven-plugin Public

    Creates CycloneDX Software Bill of Materials (SBOM) from Maven projects

    Java 316 88

  4. cyclonedx-cli cyclonedx-cli Public

    CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions.

    C# 347 63

  5. bom-examples bom-examples Public

    A repository with examples of CycloneDX BOMs (SBOM, SaaSBOM, OBOM, VEX, etc)

    192 69

  6. cyclonedx-node-module cyclonedx-node-module Public

    creates CycloneDX Software-Bill-of-Materials (SBOM) from node-based projects

    127 38

Repositories

Showing 10 of 60 repositories
  • specification Public

    OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. SBOM, SaaSBOM, HBOM, AI/ML-BOM, CBOM, OBOM, MBOM, VDR, and VEX

    CycloneDX/specification’s past year of commit activity
    XSLT 390 Apache-2.0 67 126 (5 issues need help) 14 Updated Apr 3, 2025
  • cyclonedx-node-npm Public

    Create CycloneDX Software Bill of Materials (SBOM) from Node.js NPM projects.

    CycloneDX/cyclonedx-node-npm’s past year of commit activity
    JavaScript 83 Apache-2.0 22 11 (4 issues need help) 4 Updated Apr 3, 2025
  • cyclonedx-node-yarn Public

    Create CycloneDX Software Bill of Materials (SBOM) from Node.js Yarn projects.

    CycloneDX/cyclonedx-node-yarn’s past year of commit activity
    JavaScript 21 Apache-2.0 6 15 (11 issues need help) 5 Updated Apr 3, 2025
  • cyclonedx-core-java Public

    CycloneDX SBOM Model and Utils for Creating and Validating BOMs

    CycloneDX/cyclonedx-core-java’s past year of commit activity
    Java 93 Apache-2.0 69 28 (2 issues need help) 9 Updated Apr 3, 2025
  • cyclonedx-rust-cargo Public

    Creates CycloneDX Software Bill of Materials (SBOM) from Rust (Cargo) projects

    CycloneDX/cyclonedx-rust-cargo’s past year of commit activity
    Rust 123 Apache-2.0 49 28 13 Updated Apr 3, 2025
  • cdxgen Public

    Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server. GPT: https://chatgpt.com/g/g-673bfeb4037481919be8a2cd1bf868d2-cdxgen

    CycloneDX/cdxgen’s past year of commit activity
    JavaScript 662 Apache-2.0 177 362 (29 issues need help) 12 Updated Apr 2, 2025
  • tool-center Public

    Data and schema powering the worlds largest collection of SBOM/xBOM products, projects, and services

    CycloneDX/tool-center’s past year of commit activity
    HTML 2 Apache-2.0 10 1 1 Updated Apr 2, 2025
  • cyclonedx-python-lib Public

    Python implementation of OWASP CycloneDX

    CycloneDX/cyclonedx-python-lib’s past year of commit activity
    Python 79 Apache-2.0 47 20 (14 issues need help) 9 Updated Apr 2, 2025
  • cyclonedx-webpack-plugin Public

    Generate CycloneDX Software Bill of Materials (SBOM) from webpack bundles at compile time.

    CycloneDX/cyclonedx-webpack-plugin’s past year of commit activity
    JavaScript 26 Apache-2.0 9 9 (7 issues need help) 5 Updated Apr 2, 2025
  • cyclonedx-buildroot Public

    Create CycloneDX Software Bill of Materials (SBOM) for Buildroot projects

    CycloneDX/cyclonedx-buildroot’s past year of commit activity
    Python 11 Apache-2.0 6 6 5 Updated Apr 2, 2025