Why it exists • Use cases • Input • Output • Pricing

Syft SBOM Generator

A real, standards-compliant Software Bill of Materials for any container image or public repo — CycloneDX or SPDX, ready for compliance tooling.

Verified live against python:3.9-slim: 121 real packages identified (87 deb, 19 python, 15 binary), each with exact installed version — cross-checked against the image's own package list, not estimated.

The problem this solves

SBOMs are increasingly a compliance requirement (US Executive Order 14028, EU Cyber Resilience Act), and "what's actually inside this container" is a question most teams can't answer without tooling. This Actor identifies every package Syft can positively detect — pip, npm, Go modules, Maven/Gradle, RubyGems, OS packages, and more — with exact version and declared license, not a guess.

Use cases

• Regulatory compliance — generate a CycloneDX/SPDX document to satisfy EO 14028 or EU Cyber Resilience Act SBOM requirements.
• Vendor risk assessment — request an SBOM from a third-party vendor, or generate one yourself from their public image, before approving procurement.
• License compliance audit — identify GPL/AGPL-licensed packages that may conflict with your product's licensing before shipping.
• Vulnerability response prep — keep a current SBOM on hand so that when a new CVE drops, you can immediately check exposure without re-scanning from scratch.
• M&A technical due diligence — inventory exactly what's running inside a target company's production containers.
• Feed a vulnerability matcher — pipe the generated SBOM into Grype Vulnerability Matcher for a full CVE report.

Input

Field	Type	Required	Notes
target	string	yes	Container image (nginx:1.19) or git repo URL
scanType	string	no	image or repo — auto-detected if left blank
outputFormat	string	no	cyclonedx-json (default), spdx-json, or syft-json

{ "target": "python:3.9-slim", "outputFormat": "cyclonedx-json" }

Output

One row per real package found (name, version, type, language, PURL, license), plus one sbom_summary row with totals by package type. The full SBOM document is saved to the run's key-value store under the key sbom.

One real package from a live scan:

{
  "findingType": "package",
  "target": "python:3.9-slim",
  "name": "Simple Launcher",
  "version": "1.1.0.14",
  "packageType": "binary",
  "language": "",
  "purl": "",
  "licenses": [],
  "locationPath": "/usr/local/lib/python3.9/site-packages/pip/_vendor/distlib/t32.exe",
  "scannedAt": "2026-08-01T16:35:21.630682+00:00"
}

Frequently asked questions

Which package ecosystems does it detect? Whatever Syft itself supports — OS packages (deb/rpm/apk), Python, npm, Go modules, Java (Maven/Gradle), RubyGems, and several more, all in a single pass over the target.

Where do I get the full SBOM document, not just the row-per-package view? The complete CycloneDX or SPDX JSON document is saved to the run's key-value store under the key sbom — the dataset gives you a searchable per-package view, the key-value store gives you the standards-compliant document to hand to a compliance tool.

Can I feed this straight into a vulnerability scanner? Yes — that's a common pairing. Generate the SBOM here, then run Grype Vulnerability Matcher against the same target for a CVE report matched against the exact package list.

What if a package has no declared license? It's returned with an empty licenses array rather than guessed — Syft only reports what's actually declared in the package metadata.

Limitations

• Only public container images and public git repos are supported.
• License detection reflects what the package itself declares — undeclared or non-standard license files may not be picked up.
• Binary packages (like the example above) often have empty language/purl fields since they don't carry ecosystem package-manager metadata — that's expected, not missing data.

Start generating

Give it a container image or a public repo URL and pick CycloneDX or SPDX — the format your compliance tooling expects.

Pricing

Pay per completed scan (Pay-Per-Event) — $0.49 per SBOM, charged once the SBOM is generated regardless of package count.

Related Actors

Part of a five-Actor security scanning catalog: Trivy Security Scanner, Gitleaks Secret Scanner, Grype Vulnerability Matcher (feed this SBOM straight into it), OSV-Scanner Vulnerability Checker.