- Home
- SBOM Management Software
- SBOM Manager
SBOM Manager
What it is
SBOM Manager is a free, open-source command-line tool for maintaining collections of Software Bills of Materials. It supports SPDX and CycloneDX and records components used in software releases or builds, so users can query whether particular components and versions were included. Search options include finding modules, filtering by project, listing repository contents, and viewing update history. Accepted inputs include SPDX 2.3 Tag/Value or JSON, CycloneDX 1.4 XML or JSON, CSV, and directory listings. Results can be printed to the console or written to a file in console or CSV format. Users can export a repository archive and import it to restore a repository. The project describes continuous integration and security audits as intended uses. Vulnerability scanning requires a separately configured external scanner that accepts SPDX Tag/Value files; its example names cve-bin-tool. SBOM Manager cannot determine whether an SBOM is valid or complete, so input quality needs review, and it cannot decide whether a reported vulnerability should be fixed. It runs on Linux, requires Python 3.7 or later, and is installed with pip install sbom-manager. The project is MIT licensed.
For and against
For
- Supports SPDX and CycloneDX formats.
- Queries component and version records.
- Repository archives can be exported and restored.
- Free and MIT licensed.
Against
- Requires Python 3.7 or later.
- Vulnerability scanning needs an external scanner.
- Cannot assess SBOM validity or completeness.
- Cannot determine whether vulnerabilities need fixing.
The verdict
SBOM Manager provides repository, query, and export tools for SBOM collections, with external scanning configuration available for vulnerability checks. Users remain responsible for input quality and deciding what to do about reported vulnerabilities.
Who it suits
SBOM Manager suits Linux users who want to maintain and query SBOM records in CI or security-audit workflows. Vulnerability scanning requires a separately configured external scanner.
Plans and prices
SBOM Manager
Free, open source tool; MIT licensed
Read 7 Oct 2026 · pypi.org
On the record
- Data portability
- The command line supports exporting a repository archive and importing it to restore a repository.pypi.org · read 7 Oct 2026
- Example integration
- The configuration example names cve-bin-tool as the vulnerability-scanning application.pypi.org · read 7 Oct 2026
- Input formats
- It supports SPDX 2.3 Tag/Value or JSON, CycloneDX 1.4 XML or JSON, CSV, and directory listings.pypi.org · read 7 Oct 2026
- Installation
- The project documents installation with pip install sbom-manager and requires Python 3.7 or later.pypi.org · read 7 Oct 2026
- Intended use
- The project describes use as part of continuous integration and for security audit needs.pypi.org · read 7 Oct 2026
- License
- The project is licensed under the MIT License.pypi.org · read 7 Oct 2026
- Output
- Results can be printed to the console or written to a file, with console or CSV output formats.pypi.org · read 7 Oct 2026
- Purpose
- SBOM Manager manages a collection of Software Bills of Materials (SBOMs) and supports SPDX and CycloneDX formats.pypi.org · read 7 Oct 2026
- Queries
- Users can search for modules, filter by project, list repository contents, and view update history.pypi.org · read 7 Oct 2026
- Scanning limitation
- The project says deciding whether reported vulnerabilities need fixing is beyond the tool’s capability.pypi.org · read 7 Oct 2026
- Security limitation
- The tool cannot determine whether an SBOM is valid or complete, so users are advised to check the quality of input data.pypi.org · read 7 Oct 2026
- Support
- Bug reports and feature requests can be submitted through GitHub Issues.github.com · read 7 Oct 2026
- Vulnerability scanning
- Scanning requires an external vulnerability scanner that accepts an SPDX Tag/Value SBOM file, configured by the user.pypi.org · read 7 Oct 2026
- Workflow
- It can maintain records of components in software releases or builds and query whether specific components and versions were used.pypi.org · read 7 Oct 2026
