Skip to main content
MCP Audit Docs

Software Bill of Materials

Generate and interpret offline CycloneDX component inventories.

Version Public source Maintained security documentation Reviewed Jul 21, 2026 Next review Sep 21, 2026
Start Reading Open MCP Audit GitHub Report documentation issue

Owner: Batoi Engineering Reviewed by: MCP Audit Maintainers Source revision: 8140371

Browse MCP Audit Documentation Software Bill of Materials
On this page

Software Bill of Materials

MCP Audit can generate an offline CycloneDX JSON software bill of materials for supported dependency and container declarations.

mcp-audit sbom --path . --out sbom.cdx.json

The inventory can include Go module requirements, JavaScript package dependencies, optional and development scopes, and container images declared by composed services. Provenance properties identify the source declaration, ecosystem, lockfile when present, version-pinning state, and inferred dependency scope.

Review the Result

Use the SBOM to answer which components are present, which versions are not pinned, which declarations lack a lockfile, and which container images need a separate image-security review. An SBOM improves visibility; it does not replace vulnerability analysis, license review, artifact verification, or runtime policy.