SBOM Vulnerability Auditor

Audit CycloneDX, package-lock, or simple package lists against OSV.

Input

Run with the defaults for a sample dataset. Narrow the query fields for production monitoring.

Output

The default dataset contains normalized records with these fields:

• packageName
• ecosystem
• version
• vulnerabilityId
• summary
• severity
• fixedVersions
• publishedAt
• modifiedAt
• sourceUrl

Notes

This Actor is designed as a reliable data product, not a brittle webpage scraper. Always validate regulated or legal data against the linked source before making business decisions.

How to use SBOM Vulnerability Auditor

1. Open SBOM Vulnerability Auditor on Apify Store and click Try for free.
2. Fill in the input (the form is prefilled with a working example) and click Start.
3. Watch results appear in the Output tab, then download them as JSON, CSV, Excel or HTML, or read them through the API.
4. Optional: save the input as a task and add a schedule to run it automatically, or connect it to your tools with integrations and webhooks.

How much does SBOM Vulnerability Auditor cost?

This Actor uses pay-per-event pricing: you pay only for what it delivers, and platform usage is included.

Event	Price
Result (one dataset item)	$0.005 each ($5.00 per 1,000)
Actor start	$5e-05 per run

Set Maximum cost per run in the run options to cap your spend; the Actor stops when the limit is reached. Check the Pricing tab for current prices and plan discounts.

Use SBOM Vulnerability Auditor with AI agents (MCP)

Give Claude, ChatGPT, Cursor, VS Code or any MCP client this Actor as a tool through the hosted Apify MCP server. The agent sees the input fields with descriptions and example values, runs the Actor, and reads the results.

MCP server URL (this Actor only):

https://mcp.apify.com/?tools=technicaldost/sbom-vulnerability-auditor

Claude Code:

$claude mcp add --transport http apify "https://mcp.apify.com/?tools=technicaldost/sbom-vulnerability-auditor" --header "Authorization: Bearer YOUR_APIFY_TOKEN"

Cursor, VS Code, Claude Desktop and other clients (mcp.json or the client's MCP settings):

{
  "mcpServers": {
    "apify": {
      "url": "https://mcp.apify.com/?tools=technicaldost/sbom-vulnerability-auditor",
      "headers": { "Authorization": "Bearer YOUR_APIFY_TOKEN" }
    }
  }
}

Clients that support sign-in (such as Claude.ai connectors) can use the URL without a token and log in to Apify instead. Get your token in Apify Console → Settings → API & Integrations, or generate a ready config for your client at mcp.apify.com. In the agent the tool is named technicaldost--sbom-vulnerability-auditor; ask it, for example, to "run SBOM Vulnerability Auditor with {"packageList": "npm:lodash@4.17.20\nPyPI:django@2.2.0"}".

AI agents without an Apify account can also run and pay for this Actor per request with x402 agentic payments.

Run SBOM Vulnerability Auditor via API

Run the Actor and get its results in one call (replace YOUR_APIFY_TOKEN):

curl -X POST "https://api.apify.com/v2/acts/technicaldost~sbom-vulnerability-auditor/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"packageList": "npm:lodash@4.17.20\nPyPI:django@2.2.0"}'

Python (pip install apify-client):

from apify_client import ApifyClient

client = ApifyClient("YOUR_APIFY_TOKEN")
run = client.actor("technicaldost/sbom-vulnerability-auditor").call(run_input={"packageList": "npm:lodash@4.17.20\nPyPI:django@2.2.0"})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

JavaScript / TypeScript (npm install apify-client):

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: 'YOUR_APIFY_TOKEN' });
const run = await client.actor('technicaldost/sbom-vulnerability-auditor').call({"packageList": "npm:lodash@4.17.20\nPyPI:django@2.2.0"});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

Long runs: start them with POST /v2/acts/technicaldost~sbom-vulnerability-auditor/runs and fetch the dataset when the run finishes, or receive a webhook.

Integrations

SBOM Vulnerability Auditor works with Make, Zapier, n8n, LangChain, Google Sheets, Slack, GitHub and webhooks. Schedule runs in Apify Console and send new results straight to your apps, spreadsheets or AI pipelines.

Related Actors

• Bulk Email Deliverability Auditor - SPF, DKIM, DMARC — Audit SPF, DKIM, DMARC and MX for thousands of domains at once. Returns a graded deliverability score, the par
• OSV Package Vulnerability Scanner — Find vulnerabilities for npm, PyPI, Maven, Go, NuGet, RubyGems, and crates.io packages

FAQ

Can I use SBOM Vulnerability Auditor with AI agents like Claude or ChatGPT?

Yes. Connect the Apify MCP server with ?tools=technicaldost/sbom-vulnerability-auditor (see above) and the agent can run the Actor and read its results on its own.

Can I call SBOM Vulnerability Auditor from my own code?

Yes. Use the REST API, or the official Python and JavaScript clients shown above. Results are available as JSON, CSV, Excel, XML or HTML.

How do I run it on a schedule?

Save your input as a task in Apify Console and add a schedule (for example, daily). Use webhooks or integrations to send each run's results onward.

Is it legal to use this Actor?

It works with publicly available data. Make sure your use complies with the source website's terms and with data protection laws such as GDPR, especially for personal data.

Something doesn't work or I need a feature. What should I do?

Open an issue in the Issues tab on this Actor's page with an example input, and we'll look into it.