Open source · AGPL-3.0
Active
AC Scanner
A network scanner that outputs a CBOM as structured JSON. Its README does not say which format the JSON follows.
- Does
- Generates
- Finds cryptography in
- Network traffic
A listing is not an endorsement. A tool is listed when its maintainer's own
material states that it works with CBOMs, and each entry links to that statement. Nothing here
has been tested by the working group: no entry is a claim that a tool's output conforms to a
profile, and the tool requirements in the
Conformance section are not
assessed. Details change quickly — check the source before relying on one.
Does
Licensing
Free tier
Active
AppViewX PQC Assessment Tool
Scans code, dependencies, certificates and configuration, gives a PQC readiness score, and generates a CBOM in CycloneDX or CSV. Free with registration.
- Does
- GeneratesAnalyses
- Finds cryptography in
- Source codeCertificates and keystoresConfiguration
- Formats
- CycloneDX
Commercial
Active
AQtive Guard
A platform for discovering and managing cryptographic assets that imports CBOM files produced by other tools. The product site also says it generates CBOMs; the export format is not stated.
- Does
- ConsumesGeneratesAnalyses
- Formats
- CycloneDX 1.4 (import)CycloneDX 1.6 (import)
Open source · GPL-3.0-only
Active
BF-CBOM
A research framework that runs several CBOM generators in containers and compares their output side by side.
- Does
- AnalysesConsumesVisualises
Free tier
Active
verify
CBOM Compliance
A web service that grades the cryptographic assets in an uploaded BOM against NIST PQC deadlines. The site gives no company details beyond a contact address.
- Does
- ValidatesConsumesAnalyses
- Formats
- CycloneDX 1.6CycloneDX 1.7SPDX
Open source · GPL-3.0-or-later
Active
CBOM Explorer
A browser-based viewer that loads a CBOM and shows its assets and dependencies as an interactive graph. Also offered under a commercial licence.
- Does
- VisualisesConsumes
- Formats
- CycloneDX 1.6CycloneDX 1.7
Open source · GPL-3.0-or-later
Active
CBOM Generator
A static scanner for Linux systems that inventories certificates, keys, algorithms, cryptographic libraries and services. Also offered under a commercial licence.
- Does
- Generates
- Finds cryptography in
- FilesystemsCertificates and keystoresConfiguration
- Formats
- CycloneDX 1.6CycloneDX 1.7
Commercial
Active
CBOM Secure
A discovery and inventory product with sensors for cloud platforms, HSMs, TLS endpoints, directories, databases, filesystems, source code and binaries.
- Does
- GeneratesAnalyses
- Finds cryptography in
- Source codeBinariesFilesystemsNetwork trafficCloud servicesCertificates and keystores
- Formats
- CycloneDX 1.6CycloneDX 1.7
Open source · MIT
Active
cbom-action
GitHub Actions that build a crypto bill of materials from CodeQL analysis across a set of repositories and languages. The output format is not documented.
- Does
- Generates
- Finds cryptography in
- Source code
Open source · Apache-2.0
Active
CBOM-Lens
A command-line tool or service that finds certificates, keys, secrets and algorithms on filesystems, in container images and on network ports, and writes a CBOM.
- Does
- Generates
- Finds cryptography in
- FilesystemsContainer imagesNetwork trafficCertificates and keystores
- Formats
- CycloneDX 1.6CycloneDX 1.7
Open source · Apache-2.0
Active
CBOM-Repository
A REST service on S3-compatible storage for uploading, versioning, retrieving and searching CBOMs in JSON.
- Does
- Stores and managesConsumes
- Formats
- CycloneDX 1.6CycloneDX 1.7
Open source · Apache-2.0
Active
cbom4cert
Generates a CBOM for installed certificates. One of few tools offering SPDX output, which its README describes as incomplete.
- Does
- Generates
- Finds cryptography in
- Certificates and keystores
- Formats
- CycloneDXSPDX (incomplete)
Open source · Apache-2.0
Active
cbomctl
Takes a CBOM from any generator and evaluates it against several national PQC policies. It does not scan anything itself.
- Does
- AnalysesConsumes
- Formats
- CycloneDX
Open source · Apache-2.0
Active
CBOMkit
A service with a web viewer, an API and a database: it generates CBOMs from repositories, displays uploaded CBOMs, checks them against compliance policies, and stores them behind a REST API.
- Does
- GeneratesStores and managesVisualisesAnalysesConsumes
- Finds cryptography in
- Source code
Open source · Apache-2.0
Active
CBOMkit-action
A GitHub Action that finds the modules in a repository, scans their Java and Python source, and produces one CBOM per module as a workflow artifact.
- Does
- Generates
- Finds cryptography in
- Source code
Open source · Apache-2.0
Active
CBOMkit-theia
A command-line tool that finds certificates, keys, secrets and cryptographic configuration in container images and directories and writes a CBOM, or enriches an existing one. It does not scan source code.
- Does
- GeneratesConsumes
- Finds cryptography in
- Container imagesFilesystemsCertificates and keystoresConfiguration
- Formats
- CycloneDX 1.6
Open source · Apache-2.0
Active
cdxgen
A general BOM generator whose CBOM coverage is Java keystores and certificates and algorithm use in JavaScript and TypeScript source; its tracebom command records cryptographic activity while a command runs.
- Does
- Generates
- Finds cryptography in
- Certificates and keystoresSource codeRunning systems
- Formats
- CycloneDX 1.7
Open source · MIT-0
Active
CryptaMap
Builds an organisation-wide inventory of cryptography in AWS services as a CBOM. A sample project rather than a supported AWS product.
- Does
- GeneratesAnalyses
- Finds cryptography in
- Cloud services
- Formats
- CycloneDX 1.7
Open source · Apache-2.0
Active
cryptarch
A scanner for network endpoints and certificates that can write its findings as a CBOM.
- Does
- Generates
- Finds cryptography in
- Network trafficCertificates and keystores
- Formats
- CycloneDX 1.6
Open source · GPL-3.0
Active
Cryptobom Forge
Turns CodeQL analysis results into a CBOM and checks a CBOM against rules, reporting in SARIF. Its documented output uses the CBOM extension that preceded CycloneDX 1.6.
- Does
- GeneratesAnalyses
- Finds cryptography in
- Source code
- Formats
- CycloneDX 1.4 with the pre-standard CBOM extension
Open source · Apache-2.0
Active
CryptoDeps
Analyses a project's dependencies for cryptography and can report as a CBOM. The sample output in its README declares CycloneDX 1.5, which predates cryptographic assets in CycloneDX.
- Does
- Generates
- Finds cryptography in
- Source code
Open source · Apache-2.0
Active
CryptoScan
A source code scanner with a CBOM output format. The sample output in its README declares specVersion 1.0, and CycloneDX 1.6 cryptographic properties are listed as planned.
- Does
- Generates
- Finds cryptography in
- Source code
Open source · MIT
Active
DynamicCBOM
Experimental software that traces OpenSSL 3 calls at runtime with eBPF and writes a CBOM, without changing the traced program.
- Does
- Generates
- Finds cryptography in
- Running systems
- Formats
- CycloneDX 1.6
Commercial
Active
verify
IBM Guardium Cryptography Manager
Imports code repository findings from IBM Quantum Safe Explorer, including CBOMs, into a portfolio view. CBOM is mentioned only as an imported data type.
- Does
- ConsumesAnalyses
Commercial
Active
IBM Quantum Safe Explorer
Scans source code in several languages for quantum-vulnerable cryptography and reports as a CBOM, among other formats. The documentation does not name a CycloneDX version.
- Does
- Generates
- Finds cryptography in
- Source code
Commercial
Active
Keyfactor AgileSec
A cryptographic inventory platform that exports its findings as a CBOM for each scanned source, from release 3.4.
- Does
- GeneratesAnalyses
- Finds cryptography in
- Source codeBinariesConfiguration
- Formats
- CycloneDX 1.6
Open source · MIT
Active
open-quantum-secure
A scanner that combines its own findings with those of other engines, such as CryptoScan, cdxgen and CBOMkit-theia, into one CBOM.
- Does
- GeneratesAnalyses
- Finds cryptography in
- Source codeBinariesNetwork trafficCertificates and keystores
- Formats
- CycloneDX 1.7
Open source · MIT
Active
pqaudit
An audit tool for quantum-vulnerable cryptography in code, configuration and endpoints that reports as a CBOM.
- Does
- Generates
- Finds cryptography in
- Source codeConfigurationNetwork traffic
- Formats
- CycloneDX 1.6
Open source · MIT
Active
pqc-readiness-cli
Reads PEM and DER certificate files and writes a CBOM.
- Does
- Generates
- Finds cryptography in
- Certificates and keystores
- Formats
- CycloneDX 1.7
Open source · Apache-2.0
Active
pqc-tools
A set of scanners for source code and network endpoints whose outputs include a CBOM. Its README does not name the CBOM format.
- Does
- GeneratesAnalyses
- Finds cryptography in
- Source codeNetwork traffic
Commercial
Active
QCecuring CBOM
A discovery product covering code repositories, directories, certificate authorities, web servers, cloud platforms, HSMs and Kubernetes that reports in CycloneDX JSON and XML.
- Does
- GeneratesAnalyses
- Finds cryptography in
- Source codeCertificates and keystoresNetwork trafficCloud services
- Formats
- CycloneDX
Commercial
Active
Qinsight Atlas
A cryptographic posture management platform that builds a CBOM for each scanned source. The product page does not name a format.
- Does
- GeneratesAnalyses
- Finds cryptography in
- Cloud servicesSource codeRunning systems
Commercial
Active
QScout
An assessment service and platform for quantum cryptographic risk with CBOM output among its deliverables.
- Does
- AnalysesGenerates
- Formats
- CycloneDX 1.7
Commercial
Active
QuProtect R3
A PQC platform whose reporting component produces CBOMs from the inventory its sensors build.
- Does
- GeneratesAnalyses
- Formats
- CycloneDX
Commercial
Active
QVision
A discovery platform that reconciles network, certificate, filesystem and source code observations into one CBOM.
- Does
- GeneratesAnalyses
- Finds cryptography in
- Network trafficCertificates and keystoresFilesystemsSource code
- Formats
- CycloneDX 1.7
Open source · MIT
Active
sbom-tools
A tool for diffing, quality scoring and compliance checks of BOMs that reads the cryptographic properties of CycloneDX 1.6 and 1.7 documents and tells a CBOM from an SBOM.
- Does
- AnalysesConsumesValidatesVisualises
- Formats
- CycloneDX 1.6CycloneDX 1.7
Open source · Apache-2.0
Active
Sonar Cryptography Plugin
A SonarQube plugin, also known as CBOMkit-hyperion, that detects cryptographic assets in Java, Python and Go source and writes a CBOM when its Cryptographic Inventory rule is enabled.
- Does
- Generates
- Finds cryptography in
- Source code
- Formats
- CycloneDX 1.6
Open source · MIT
Active
TLS Analyzer
Analyses TLS endpoints and can report as a CBOM.
- Does
- Generates
- Finds cryptography in
- Network traffic
- Formats
- CycloneDX
Commercial
Active
TYCHON Cryptographic Inventory
A cryptographic inventory product with quantum readiness scoring that lists CBOM as an inventory output.
- Does
- GeneratesAnalyses
- Formats
- CycloneDX
No tools match those filters.
Know a tool that should be here, or an entry that is out of date? Email
cbom@lists.pkic.org
with a link to where its maintainer states CBOM support — see
Contributing. Maintainers add
entries to
docs/_data/tooling.yml
following CONTRIBUTING-tooling.md.