Sbom Cyclonedx Mcp

io.github.CSOAI-ORGPublished by GitHub account CSOAI-ORGv1.0.5Updated Oct 30, 2026

Software Bill of Materials generation + validation in CycloneDX 1.6 and SPDX 2.3 formats. Requir...

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Local MCP server that lets an assistant generate and validate software bills of materials in CycloneDX 1.6 and SPDX 2.3 formats.

What you can do
  • Generate a CycloneDX 1.6 SBOM for a project or dependency set
  • Generate an SPDX 2.3 SBOM
  • Validate an existing SBOM document
  • Runs locally over stdio as a Python package, so the assistant can produce compliance-oriented inventory files on request
When to use it
Useful when you need SBOM artifacts for supply-chain or regulatory work such as EO 14028, NIS2 or the CRA, or want an assistant to check an existing CycloneDX or SPDX file for validity.
Requirements
Runs as a local process on the user's machine (desktop only), installed from PyPI as sbom-cyclonedx-mcp and started with Python, for example via uvx or pip. No authentication, environment variables or headers are declared.
Before you install
The README mixes the SBOM tool with paid tiers, Stripe purchase links and EU AI Act compliance claims; the free tier is described as limited to 10 calls per day, with paid plans for unlimited use and signed attestations. Treat the compliance checkmarks as marketing claims and verify pricing and licensing before relying on it.

Installation

In SourceWeft

  1. Open Sbom Cyclonedx Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

[MCP Scorecard: 90/100]

Sbom Cyclonedx MCP

[MEOK AI Labs] [GSPC] [License] [PyPI]

SBOM generation in CycloneDX 1

SBOM generation in CycloneDX 1.6 + SPDX 2.3. Required by EO 14028, NIS2, CRA. MIT

🚀 Quick Start

bash
# Install via pippip install sbom_cyclonedx_mcp
# Or install via Smitherynpx -y @smithery/cli@latest install sbom-cyclonedx-mcp --client claude

✨ Features

  • MCP protocol compliant
  • Easy installation
  • Well-documented API
  • Production-ready
  • Active maintenance

📖 Documentation

🛡️ Compliance

This MCP server is built with EU AI Act compliance built-in:

  • Free: 10 calls/day. No API key required.

  • Pro £79/mo: unlimited + signed attestations. Subscribe

  • Enterprise £1,499/mo: white-label + on-premise + SLA. [email protected]

  • ✅ Article 9 — Risk Management System

  • ✅ Article 13 — Transparency & Instructions for Use

  • ✅ Article 15 — Bias Detection & Testing

  • ✅ Article 26 — FRIA Support (where applicable)

  • ✅ Article 50 — AI Content Watermarking (where applicable)

Need help getting compliant? Book a free 15-min diagnostic →

🏢 Enterprise

Need custom development, SLA guarantees, or white-label deployment?

  • Pro: $99/mo — Full MCP suite + EU AI Act tracking
  • Enterprise: $499/mo — Custom dev + SLA + Dedicated support

View Pricing → | Contact Sales →

🤝 Part of the MEOK Ecosystem

This server is part of the MEOK AI Labs ecosystem — 300+ MCP servers for sovereign AI governance.

DomainPurpose
councilof.aiEU AI Act compliance marketplace
safetyof.aiAI safety & monitoring
meok.aiSovereign AI platform
cobolbridge.aiLegacy modernization

📜 License

MIT © CSOAI-ORG

Built with 💜 by MEOK AI Labs · UK Companies House 16939677

**Agent interop protocols supported (8 live):**
  • ✅ MCP (Anthropic) — native
  • ✅ A2A (Google + Linux Foundation, absorbed IBM ACP Sept 2025)
  • ✅ IBM ACP — covered via A2A merge
  • ◐ Stripe ACP (Agentic Commerce Protocol) — Q3 bridge via agent-commerce-protocol-mcp
  • ◐ AP2 (Google Agent Payments) — partial via agent-commerce-payments-mcp
  • ◐ x402 (Coinbase HTTP 402) — partial via api.meok.ai gateway
  • → OASF / AGNTCY (Cisco Outshift + Linux Foundation) — Q3 bridge
  • 👁 ANP (Cisco Agent Network) — watch-list

Pricing options:

OptionPriceBest for
Self-host (this MCP)£0 — MITDevs
This MCP Starter£29/moOne-MCP teams
This MCP Pro£79/moProduction + 24h SLA
Universal PAYG£29/mo + £0.0002/callSpiky usage across many MCPs
Substrate bundle (this category)£99-£499/moA whole pack
MEOK Universe£1,499/moAll 47 MCPs, 500K calls

Each tier above the free self-host adds HMAC-signed attestations verifiable at verify.meok.ai. Linux Foundation governance on the A2A spine means EU regulated buyers can deploy without vendor-lock-in objections.

💸 Try MEOK in 30 seconds — instant buy ladder

TierPriceWhat you getStripe
Smoke test£1Signed sample MCP-Hardening report + Article 50 PDFhttps://buy.stripe.com/aFa7sNcgAdQS0ZT1Uc8k91t
Quick Kit£9EU AI Act Article 50 implementation guide (C2PA + EU-Icon)https://buy.stripe.com/aFa7sNcgAdQS0ZT1Uc8k91t
Founder Call£2930-min 1-on-1 with the founderhttps://buy.stripe.com/aFa7sNcgAdQS0ZT1Uc8k91t

Refundable. UK Stripe — VAT-clean. Builds on the 81-MCP MEOK fleet. Verify any signed report at https://meok.ai/verify.

Configuration

Add to your claude_desktop_config.json (Claude Desktop) or your MCP client config:

json
{  "mcpServers": {    "sbom-cyclonedx-mcp": {      "command": "uvx",      "args": ["sbom-cyclonedx-mcp"]    }  }}

Or: pip install sbom-cyclonedx-mcp then run the sbom-cyclonedx-mcp command (stdio transport).

Examples

Once configured, ask your assistant, for example:

  • "Use generate_sbom_cyclonedx to …"
  • "Use generate_sbom_spdx to …"
  • "Use validate_sbom to …"

Source: README.md at commit 06a0898

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.5LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts