Generate Software Bill of Materials (SBOMs), scan for vulnerabilities, and analyze project dependencies from local codebases or Git repositories. Built for developers who need automated supply chain visibility and security insights.
io.github.mcpsbom/sbom-mcp
https://mcp.sbomapp.com/mcp
HTTP
No auth required
How models use it and what it is built for.
Generate Software Bill of Materials (SBOMs), scan for vulnerabilities, and analyze project dependencies from local codebases or Git repositories. Built for developers who need automated supply chain visibility and security insights.
Hosted endpoint — paste into any MCP client.
Where to find authoritative docs and source for SBOMApp - SBOM Generator & Vulnerability Scanner.
Paste any of these into Agent Studio after connecting SBOMApp - SBOM Generator & Vulnerability Scanner.
Common questions about connecting and running SBOMApp - SBOM Generator & Vulnerability Scanner.
What SBOM formats does this server support?
The server generates SBOMs and supports standard formats for supply chain analysis. Check the hosted endpoint documentation at https://mcp.sbomapp.com/mcp for specific format options like SPDX, CycloneDX, or others.
Can I scan a private Git repository?
The server accepts Git repos as input for scanning. For private repos, you'll likely need to provide authentication credentials or SSH keys; consult the endpoint documentation for auth setup details.
Does it work with monorepos or just single projects?
The server analyzes dependencies from local projects and Git repos. Monorepo support depends on the underlying tooling; refer to the documentation to confirm multi-package project handling.
What vulnerability databases does it use for scanning?
The server scans for known vulnerabilities in dependencies. The specific vulnerability sources (NVD, GitHub Security Advisory, etc.) are documented at the hosted endpoint.
Is there a rate limit or cost for using this MCP server?
This is an HTTP-based MCP server hosted at https://mcp.sbomapp.com/mcp. Pricing and rate limits should be documented on the sbomapp.com site or in the endpoint's terms of service.
Connect SBOMApp - SBOM Generator & Vulnerability Scanner to Claude, GPT, Gemini, DeepSeek and 60+ AI models in MCP Agent Studio. Compare answers side-by-side, save reusable agent presets, share runs — all in your browser, no install required.
Open Agent StudioJudges Panel
45 judges that evaluate AI-generated code for security, cost, and quality with built-in AST.
Addozhang Nexus
Query Sonatype Nexus Repository (OSS/Pro) for Maven, Python, and Docker artifacts
Cyanheads MCP Ts Template
TypeScript template for building MCP servers with declarative tooling, observability, and auth.
Chernistry Bernstein
Declarative agent orchestration for engineering teams