sbomify

Most teams can produce an SBOM. Far fewer can tell you which version shipped, whether it meets the rules that now apply, or hand it to a customer without a week of digging. sbomify answers those questions, and gives you a trust center to answer them from.

Bring SBOMs in from wherever they are made. Upload through the web interface or the API, or wire up CI with the sbomify GitHub Action. Anything valid in CycloneDX or SPDX is welcome, whichever tool produced it.

Once inside, they are organised the way you actually ship. Components hold SBOMs or documents. Products group the components you sell. Releases are versioned snapshots, so a question about last quarter's build has an exact answer. Workspaces decide who sees what.

Compliance is checked, not assumed. Built in plugins validate against the EU Cyber Resilience Act (BSI TR-03183-2), NTIA Minimum Elements, the CISA 2025 draft and FDA medical device guidance, and vulnerability scanning runs alongside. You find out where you stand before a customer does.

Then you publish. Your trust center gives customers a public page per product, the CycloneDX Transparency Exchange API serves machines that ask on their own, and an MCP server lets AI agents query your workspace directly.

Alongside SBOMs, sbomify stores the documents that travel with them: specifications, manuals, audit reports, attestations.

Open source. Self host it, or use app.sbomify.com.