SBOMApp - SBOM Generator & Vulnerability Scanner
This server connects your editor to SBOMApp's hosted service for software supply chain analysis. It exposes tools to generate SBOMs in SPDX or CycloneDX formats, scan for CVEs with remediation guidance, analyze transitive dependencies, and flag license compliance issues. Works on local workspaces or remote Git repos. You'd reach for this when auditing third-party code, preparing compliance artifacts, or checking what dependencies an AI-generated snippet just pulled in. Uses bearer token auth with a 90-day free trial (100 requests), then requires a paid plan. Runs over streamable HTTP, so no local installation beyond the VS Code extension.
- tools
- 4
- auth
- Secret needed
- transport
- HTTP
- last updated
- Feb 23, 2026
Tools
4 toolsPublic tool metadata for what this MCP can expose to an agent.
sbomapp_generateSbomFromWorkspaceGenerate SBOM, scan vulnerabilities, analyze dependencies, and check licenses for your current project
Generate SBOM, scan vulnerabilities, analyze dependencies, and check licenses for your current project
No parameter schema in public metadata yet.
generate_sbomGenerate a complete SBOM with vulnerability report for your project
Generate a complete SBOM with vulnerability report for your project
No parameter schema in public metadata yet.
scan_vulnerabilitiesScan your project for security vulnerabilities with CVE details
Scan your project for security vulnerabilities with CVE details
No parameter schema in public metadata yet.
analyze_dependenciesAnalyze all dependencies — types, licenses, and risk assessment
Analyze all dependencies — types, licenses, and risk assessment
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageReadme
SBOM for VS Code by SBOMApp!
“AI wrote the code – now audit what’s inside”
SBOM MCP Server - SBOMApp MCP Server brings software supplychain security assistant inside VS Code. With a simple natural language prompt, developers can instantly generate SBOMs (SPDX/CycloneDX), scan for CVEs, Verify Licence Compliance, and get actionable remediation guidance.
No switching tools, no manual scripts, everything happens right inside your editor, keeping you fast, secure, and focused.
Why teams choose SBOMApp MCP:
Endtoend visibility: Build complete SBOMs (including transitive deps) from local workspaces or Git repos, then attach them to builds and releases.
Actionable security: Run vulnerability scans, drill into CVE details, and get fix versions and upgrade paths.
License clarity: Identify copyleft and other risky licenses early with auditfriendly summaries.
Copilot + MCP native: Works naturally in Agent Mode, so prompts like “generate sbom”, “scan vulnerabilities”
Details
- Repository
- github.com/mcpsbom/sbomapp-mcp-server
- Category
- Developer Tools
- Transport
- HTTP
- Auth
- Required
- Registry
- MCP registry, active
Related Developer Tools MCP servers
View all
Mitre Attckpipeworx-io/mcp-mitre-attckMITRE ATT&CK MCP — STIX bundles from github.com/mitre/cti.0starsSuperheropipeworx-io/mcp-superheroSuperhero MCP — wraps akabab.github.io/superhero-api (free, no auth)0stars
Qtm4j Mcp Serversalehrifai42/qmetrymcpMCP server for QMetry Test Management for Jira (QTM4J): test cases, cycles, executions, plans.0stars
Omnidosaschahenning/omnido-releasesTask app that keeps the source of each task: mail, Teams message or terminal session.0stars