SBOMApp - SBOM Generator & Vulnerability Scanner

io.github.mcpsbom由 GitHub 账号 mcpsbom 发布v1.1.0更新于 Oct 24, 2026

Generate SBOMs, scan vulnerabilities, and analyze dependencies from local projects or Git repos.

已验证Streamable HTTP可网页运行开发者工具安全与监控

概览

AI 生成的概览

远程 MCP 服务器，让助手生成 SBOM、扫描项目漏洞并分析依赖许可证。

可以做什么
为当前工作区或 Git 仓库生成完整 SBOM（SPDX/CycloneDX），包含传递依赖，并可附带漏洞报告用于构建和发布。扫描项目或指定包版本的漏洞，查看 CVE 详情、修复版本和升级路径。分析全部依赖的类型、许可证和风险，以便于审计的摘要标出 copyleft 等高风险许可证。一次调用即可对当前项目完成生成、扫描、依赖与许可证检查。
适用场景
适合需要为受监管软件、客户 SBOM 请求或 SDLC 加固准备 SBOM 的安全团队，希望不离开编辑器、不写脚本就获得 CVE 和许可证信息。
运行要求
需通过 streamable HTTP 连接 mcp.sbomapp.com 远程端点，使用 Authorization 头携带 bearer API 密钥，并具备网络访问。README 说明需 VS Code 1.106 或更高版本并启用语言模型；可用邮箱激活免费试用，或手动输入企业许可证密钥。
安装前请注意
需要付费或试用 API 密钥；试用有令牌额度限制，升级 Pro 涉及付款。README 称不存储代码、SBOM 和依赖，仅保存邮箱和 API 令牌，但分析由远程服务完成，项目数据会离开本机。请将 API 密钥视为机密，并在依赖前确认试用与令牌条款。

安装

在 SourceWeft 中

  1. 打开 控制台中的 SBOMApp - SBOM Generator & Vulnerability Scanner，将其添加到工作区。
  2. 连接 Authorization token 凭据。它们会被私密存储，绝不会在公开页面上展示。
  3. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/io.github.mcpsbom%2Fsbom-mcp/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "sbomapp-sbom-generator-vulnerability-sca": {
      "type": "http",
      "url": "https://mcp.sbomapp.com/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_TOKEN>"
      }
    }
  }
}

README

SBOM for VS Code by SBOMApp!

“AI wrote the code – now audit what’s inside”

SBOM MCP Server - SBOMApp MCP Server brings software supplychain security assistant inside VS Code. With a simple natural language prompt, developers can instantly generate SBOMs (SPDX/CycloneDX), scan for CVEs, Verify Licence Compliance, and get actionable remediation guidance.

No switching tools, no manual scripts, everything happens right inside your editor, keeping you fast, secure, and focused.

[alt text]

Why teams choose SBOMApp MCP:

Endtoend visibility: Build complete SBOMs (including transitive deps) from local workspaces or Git repos, then attach them to builds and releases.

Actionable security: Run vulnerability scans, drill into CVE details, and get fix versions and upgrade paths.

License clarity: Identify copyleft and other risky licenses early with auditfriendly summaries.

Copilot + MCP native: Works naturally in Agent Mode, so prompts like “generate sbom”, “scan vulnerabilities” 

Frictionless onboarding: Start with a 7day free trial or connect your enterprise server using secure tokens stored by VS Code.

Designed for securityminded engineering orgs: Whether you’re shipping regulated software, hardening your SDLC, or preparing for customer SBOM requests, SBOMApp MCP delivers the SBOM, CVE, and license insights your teams need

Absolute Privacy Guarantee!

We don’t store your code, your SBOMs, your dependencies, or any project data — ever. Only your email (for free trial) and API token are stored securely. Everything else stays completely on your machine.

SBOMApp MCP Server

Connect to a remote SBOM MCP Server to perform software bill of materials analysis, vulnerability scanning, opensource license details and dependency management.

Quick Start Guide

Step 1: Install the Extension

  1. Open VS Code
  2. Go to Extensions (Ctrl+Shift+X or Cmd+Shift+X on Mac)
  3. Search for "SBOMApp MCP Server"
  4. Click Install

Or install directly from the VS Code Marketplace

Step 2: Free Trial - Get Started Instantly!

New users get a FREE 90-day trial with 100 Tokens - no credit card required!

Automatic Trial Registration:
  1. Install the extension
  2. On first launch, you'll be prompted to start your free trial
  3. Enter your email address
  4. Your API key is automatically configured - you're ready to go!

Simple steps to Activate Trial!

prerequisites : Visual Studio Code should be Installed with langauage Models enabled.

  • Click on the SBOM MCP status bar!

  • Click on the start free trial option,

  • Click on th start free trial popup,

  • Enter your official email-id & click Enter,

  • After sucessful Registration, you will get the trial activation notification!

  • Reload the Window using the command "CTRL+SHIFT+P" or click "Command Palette" and Select "Developer:Reload Window" to Refresh the MCP Server!

Trial Features:
FeatureTrial
Validity90 days
Token Requests100 tokens
SBOM Generationyes
Vulnerability Scanningyes
Upgrade to Pro:

When your trial expires or tokens are exhausted, upgrade at: https://payment.sbomapp.com or https://sbomapp.com

Manual Configuration (Enterprise Users):

If you have a license key from your administrator:

  1. Press Ctrl+Shift+P → "SBOMApp: Configure Remote Server"
  2. Enter your Server URL: https://mcp.sbomapp.com/mcp
  3. Enter your API Key

Step 3: Test the Connection

  1. Press Ctrl+Shift+P again
  2. Type "SBOMApp: Test Connection" and press Enter
  3. You should see a success message with available tools count

Step 4: Restart the VS code.

Mandatory step! Once credentials and connections are tested, Kindly restart the VS Code.

Step 5: Start Using "@sbomapp" in chat box

Once connected (green status bar shows ✓), you can ask GitHub Copilot:

Note: Ensure your project is imported in VS Code before using SBOMApp MCP.

"@sbomapp/help""@sbomapp Generate an SBOM for my current project or Generate an SBOM for my current project"."@sbomapp scan vulnerabilities" or "Check if lodash 4.17.0 has any security vulnerabilities"

Features

  • Easy Configuration: Simple setup wizard to connect to your SBOM MCP Server
  • Secure Authentication: Bearer token authentication with secure storage
  • Connection Testing: Verify your server connection before use
  • Status Bar Indicator: See connection status at a glance
  • Tool Browser: View all available SBOM analysis tools
  • Direct Tool: Say "@sbomapp Generate SBOM for my current project" in chat - it just works!

Commands

CommandDescription
SBOMApp: Start Free TrialRegister for a free 7-day trial
SBOMApp: Check Trial StatusView remaining tokens and expiry
SBOMApp: Check Token UsageView detailed Token usage statistics
SBOMApp: Configure Remote ServerSet up server URL and API key
SBOMApp: Test ConnectionVerify connection to the server
SBOMApp: Show Available ToolsBrowse available SBOM analysis tools
SBOMApp: DisconnectDisconnect from the server

Configuration

This extension provides the following settings:

SettingDescriptionDefault
sbomRemoteMcp.serverUrlURL of the remote SBOM MCP Server(empty)
sbomRemoteMcp.apiKeyAPI key for authentication(empty)
sbomRemoteMcp.autoConnectAuto-connect on VS Code startuptrue
sbomRemoteMcp.showStatusBarShow status in status bartrue

Available Tools

Once connected, you can use these SBOM analysis tools with GitHub Copilot:

ToolDescription
sbomapp_generateSbomFromWorkspaceGenerate SBOM, scan vulnerabilities, analyze dependencies, and check licenses for your current project
generate_sbomGenerate a complete SBOM with vulnerability report for your project
scan_vulnerabilitiesScan your project for security vulnerabilities with CVE details
analyze_dependenciesAnalyze all dependencies — types, licenses, and risk assessment

Tip: Just type "generate sbom", "scan vulnerabilities", or "analyze dependencies" in Copilot chat — the extension automatically analyzes your current project!

Example Copilot Prompts after SBOM and vulnerabilities Generation

Try asking Copilot these questions:

  • "Fix the above Identified vulnerabilities"
  • "Replace component_1 with suitable secure component"

Requirements

  • VS Code 1.106 or higher
  • Access to a running SBOM MCP Server
  • Valid API key for authentication

Getting an API Key

Option 1: Free Trial (Recommended for Individual Users)

  • Start the extension and follow the trial registration prompt
  • Or run command: SBOMApp: Start Free Trial
  • Trial includes: 90 days, 100 Tokens

Option 2: Purchase Pro License

Option 3: Enterprise License

Troubleshooting

Connection Failed

  • Verify the server URL is correct (should end with /mcp)
  • Check that the server is running and accessible
  • Ensure your API key is valid and not expired
  • Check if firewall allows the connection

Tools Not Working

  • Make sure the connection is established (green ✓ in status bar)
  • Check VS Code MCP settings are configured correctly
  • Try disconnecting and reconnecting
  • Restart VS Code if issues persist

Status Bar Not Showing

  • Check that sbomRemoteMcp.showStatusBar is enabled in settings
  • Try reloading VS Code (Ctrl+Shift+P → "Reload Window")

Check Token Usage Status

  • Click on the status bar "SBOM MCP" → Select "Check token Usage"
  • View detailed usage statistics in the output panel

Check Trial Status

  • Click on the status bar "SBOM MCP" → Select "Check Trial Status"
  • View remaining tokens, days left, and upgrade options
  • Status bar shows trial info: ✓ SBOM MCP [Trial: 450]

Trial Expired or Tokens Exhausted

  • Status bar shows: SBOM MCP [Trial Expired]
  • Click "Upgrade Now" in the popup to purchase Pro license
  • Or run command: SBOMApp: Configure Remote Server to enter a new API key
  • Upgrade at: https://payment.sbomapp.com or https://sbomapp.com

Authentication Errors

  • Verify your API key is correct
  • Ensure the API key has proper permissions
  • Contact your administrator if the key was recently rotated

Privacy & Security

  • API keys are stored in VS Code's secure storage
  • All communication uses HTTPS (when configured)
  • No data is sent to third parties
  • Credentials are never logged or exported

Support

来源：README.md，提交 3ea29bd

工具

0
SourceWeft 尚未读取此服务器的工具。

版本历史

1
  1. v1.1.0最新Sep 16, 2026

评分

已满足适用检查项的 75%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分

    请在仓库或注册中心条目中声明许可证。