SBOMApp - SBOM Generator & Vulnerability Scanner

io.github.mcpsbom由 GitHub 帳號 mcpsbom 發布v1.1.0更新於 Oct 24, 2026

Generate SBOMs, scan vulnerabilities, and analyze dependencies from local projects or Git repos.

已驗證Streamable HTTP可網頁執行開發者工具安全與監控

概覽

AI 產生的概覽

遠端 MCP 伺服器，讓助理產生 SBOM、掃描專案漏洞並分析相依套件授權。

可以做什麼
為目前工作區或 Git 儲存庫產生完整 SBOM（SPDX/CycloneDX），包含遞移相依，並可附上漏洞報告供建置與發佈使用。掃描專案或指定套件版本的漏洞，檢視 CVE 詳情、修正版本與升級路徑。分析所有相依套件的類型、授權與風險，以易於稽核的摘要標出 copyleft 等高風險授權。一次呼叫即可對目前專案完成產生、掃描、相依與授權檢查。
適用情境
適合需要為受監管軟體、客戶 SBOM 要求或 SDLC 強化準備 SBOM 的安全團隊，希望不離開編輯器、不寫指令碼就取得 CVE 與授權資訊。
執行需求
需透過 streamable HTTP 連線至 mcp.sbomapp.com 遠端端點，於 Authorization 標頭攜帶 bearer API 金鑰，並具備網路存取。README 說明需 VS Code 1.106 以上版本並啟用語言模型；可用電子郵件啟用免費試用，或手動輸入企業授權金鑰。
安裝前請注意
需要付費或試用 API 金鑰；試用有權杖額度限制，升級 Pro 涉及付款。README 稱不儲存程式碼、SBOM 與相依套件，僅保存電子郵件與 API 權杖，但分析由遠端服務執行，專案資料會離開本機。請將 API 金鑰視為機密，並在依賴前確認試用與權杖條款。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 SBOMApp - SBOM Generator & Vulnerability Scanner，將其新增到工作區。
  2. 連接 Authorization token 憑證。它們會被私密儲存，絕不會在公開頁面上展示。
  3. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.github.mcpsbom%2Fsbom-mcp/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "sbomapp-sbom-generator-vulnerability-sca": {
      "type": "http",
      "url": "https://mcp.sbomapp.com/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_TOKEN>"
      }
    }
  }
}

README

SBOM for VS Code by SBOMApp!

“AI wrote the code – now audit what’s inside”

SBOM MCP Server - SBOMApp MCP Server brings software supplychain security assistant inside VS Code. With a simple natural language prompt, developers can instantly generate SBOMs (SPDX/CycloneDX), scan for CVEs, Verify Licence Compliance, and get actionable remediation guidance.

No switching tools, no manual scripts, everything happens right inside your editor, keeping you fast, secure, and focused.

[alt text]

Why teams choose SBOMApp MCP:

Endtoend visibility: Build complete SBOMs (including transitive deps) from local workspaces or Git repos, then attach them to builds and releases.

Actionable security: Run vulnerability scans, drill into CVE details, and get fix versions and upgrade paths.

License clarity: Identify copyleft and other risky licenses early with auditfriendly summaries.

Copilot + MCP native: Works naturally in Agent Mode, so prompts like “generate sbom”, “scan vulnerabilities” 

Frictionless onboarding: Start with a 7day free trial or connect your enterprise server using secure tokens stored by VS Code.

Designed for securityminded engineering orgs: Whether you’re shipping regulated software, hardening your SDLC, or preparing for customer SBOM requests, SBOMApp MCP delivers the SBOM, CVE, and license insights your teams need

Absolute Privacy Guarantee!

We don’t store your code, your SBOMs, your dependencies, or any project data — ever. Only your email (for free trial) and API token are stored securely. Everything else stays completely on your machine.

SBOMApp MCP Server

Connect to a remote SBOM MCP Server to perform software bill of materials analysis, vulnerability scanning, opensource license details and dependency management.

Quick Start Guide

Step 1: Install the Extension

  1. Open VS Code
  2. Go to Extensions (Ctrl+Shift+X or Cmd+Shift+X on Mac)
  3. Search for "SBOMApp MCP Server"
  4. Click Install

Or install directly from the VS Code Marketplace

Step 2: Free Trial - Get Started Instantly!

New users get a FREE 90-day trial with 100 Tokens - no credit card required!

Automatic Trial Registration:
  1. Install the extension
  2. On first launch, you'll be prompted to start your free trial
  3. Enter your email address
  4. Your API key is automatically configured - you're ready to go!

Simple steps to Activate Trial!

prerequisites : Visual Studio Code should be Installed with langauage Models enabled.

  • Click on the SBOM MCP status bar!

  • Click on the start free trial option,

  • Click on th start free trial popup,

  • Enter your official email-id & click Enter,

  • After sucessful Registration, you will get the trial activation notification!

  • Reload the Window using the command "CTRL+SHIFT+P" or click "Command Palette" and Select "Developer:Reload Window" to Refresh the MCP Server!

Trial Features:
FeatureTrial
Validity90 days
Token Requests100 tokens
SBOM Generationyes
Vulnerability Scanningyes
Upgrade to Pro:

When your trial expires or tokens are exhausted, upgrade at: https://payment.sbomapp.com or https://sbomapp.com

Manual Configuration (Enterprise Users):

If you have a license key from your administrator:

  1. Press Ctrl+Shift+P → "SBOMApp: Configure Remote Server"
  2. Enter your Server URL: https://mcp.sbomapp.com/mcp
  3. Enter your API Key

Step 3: Test the Connection

  1. Press Ctrl+Shift+P again
  2. Type "SBOMApp: Test Connection" and press Enter
  3. You should see a success message with available tools count

Step 4: Restart the VS code.

Mandatory step! Once credentials and connections are tested, Kindly restart the VS Code.

Step 5: Start Using "@sbomapp" in chat box

Once connected (green status bar shows ✓), you can ask GitHub Copilot:

Note: Ensure your project is imported in VS Code before using SBOMApp MCP.

"@sbomapp/help""@sbomapp Generate an SBOM for my current project or Generate an SBOM for my current project"."@sbomapp scan vulnerabilities" or "Check if lodash 4.17.0 has any security vulnerabilities"

Features

  • Easy Configuration: Simple setup wizard to connect to your SBOM MCP Server
  • Secure Authentication: Bearer token authentication with secure storage
  • Connection Testing: Verify your server connection before use
  • Status Bar Indicator: See connection status at a glance
  • Tool Browser: View all available SBOM analysis tools
  • Direct Tool: Say "@sbomapp Generate SBOM for my current project" in chat - it just works!

Commands

CommandDescription
SBOMApp: Start Free TrialRegister for a free 7-day trial
SBOMApp: Check Trial StatusView remaining tokens and expiry
SBOMApp: Check Token UsageView detailed Token usage statistics
SBOMApp: Configure Remote ServerSet up server URL and API key
SBOMApp: Test ConnectionVerify connection to the server
SBOMApp: Show Available ToolsBrowse available SBOM analysis tools
SBOMApp: DisconnectDisconnect from the server

Configuration

This extension provides the following settings:

SettingDescriptionDefault
sbomRemoteMcp.serverUrlURL of the remote SBOM MCP Server(empty)
sbomRemoteMcp.apiKeyAPI key for authentication(empty)
sbomRemoteMcp.autoConnectAuto-connect on VS Code startuptrue
sbomRemoteMcp.showStatusBarShow status in status bartrue

Available Tools

Once connected, you can use these SBOM analysis tools with GitHub Copilot:

ToolDescription
sbomapp_generateSbomFromWorkspaceGenerate SBOM, scan vulnerabilities, analyze dependencies, and check licenses for your current project
generate_sbomGenerate a complete SBOM with vulnerability report for your project
scan_vulnerabilitiesScan your project for security vulnerabilities with CVE details
analyze_dependenciesAnalyze all dependencies — types, licenses, and risk assessment

Tip: Just type "generate sbom", "scan vulnerabilities", or "analyze dependencies" in Copilot chat — the extension automatically analyzes your current project!

Example Copilot Prompts after SBOM and vulnerabilities Generation

Try asking Copilot these questions:

  • "Fix the above Identified vulnerabilities"
  • "Replace component_1 with suitable secure component"

Requirements

  • VS Code 1.106 or higher
  • Access to a running SBOM MCP Server
  • Valid API key for authentication

Getting an API Key

Option 1: Free Trial (Recommended for Individual Users)

  • Start the extension and follow the trial registration prompt
  • Or run command: SBOMApp: Start Free Trial
  • Trial includes: 90 days, 100 Tokens

Option 2: Purchase Pro License

Option 3: Enterprise License

Troubleshooting

Connection Failed

  • Verify the server URL is correct (should end with /mcp)
  • Check that the server is running and accessible
  • Ensure your API key is valid and not expired
  • Check if firewall allows the connection

Tools Not Working

  • Make sure the connection is established (green ✓ in status bar)
  • Check VS Code MCP settings are configured correctly
  • Try disconnecting and reconnecting
  • Restart VS Code if issues persist

Status Bar Not Showing

  • Check that sbomRemoteMcp.showStatusBar is enabled in settings
  • Try reloading VS Code (Ctrl+Shift+P → "Reload Window")

Check Token Usage Status

  • Click on the status bar "SBOM MCP" → Select "Check token Usage"
  • View detailed usage statistics in the output panel

Check Trial Status

  • Click on the status bar "SBOM MCP" → Select "Check Trial Status"
  • View remaining tokens, days left, and upgrade options
  • Status bar shows trial info: ✓ SBOM MCP [Trial: 450]

Trial Expired or Tokens Exhausted

  • Status bar shows: SBOM MCP [Trial Expired]
  • Click "Upgrade Now" in the popup to purchase Pro license
  • Or run command: SBOMApp: Configure Remote Server to enter a new API key
  • Upgrade at: https://payment.sbomapp.com or https://sbomapp.com

Authentication Errors

  • Verify your API key is correct
  • Ensure the API key has proper permissions
  • Contact your administrator if the key was recently rotated

Privacy & Security

  • API keys are stored in VS Code's secure storage
  • All communication uses HTTPS (when configured)
  • No data is sent to third parties
  • Credentials are never logged or exported

Support

來源：README.md，提交 3ea29bd

工具

0
SourceWeft 尚未讀取此伺服器的工具。

版本歷史

1
  1. v1.1.0最新Sep 16, 2026

評分

已滿足適用檢查項的 75%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分

    請在儲存庫或註冊中心條目中宣告授權條款。