Dependency SBOM Auditor

Turn any dependency manifest into a clean dependency list and a CycloneDX-style SBOM (JSON) — fully deterministic, pure code, no AI.

What it does

Give it a manifest as pasted text (manifest_text) or a public raw URL (manifest_url) and it:

1. Auto-detects the ecosystem (or you force it with manifest_type).
2. Parses the dependencies deterministically.
3. Returns a normalized component list (

   {name, version, version_spec, pinned, ecosystem, scope}
   ) plus a CycloneDX 1.5 SBOM (sbom) with PURLs.
4. Optionally enriches pinned dependencies with known vulnerabilities from the free, keyless public OSV.dev API (check_advisories: true, off by default, hard-capped at 50 lookups/run).

Supported manifests

manifest_type	File
npm	package.json
pip	requirements.txt
pyproject	pyproject.toml (PEP 621 + Poetry)
gomod	go.mod
cargo	Cargo.toml
gem	Gemfile
composer	composer.json
auto	detect from URL filename / content

Cost & safety

• SBOM / dependency listing is pure parsing — $0, fully deterministic, no AI, no paid API.
• Advisory enrichment is optional and uses only the free, keyless public OSV.dev API (no API key, no paid feed), bounded to 50 lookups/run.
• Any URL fetch (manifest URL or OSV) goes through an always-on SSRF guard (private/loopback/reserved-IP block, fail-closed) with hard size/time caps.

Input

{
  "manifest_text": "{\n  \"dependencies\": { \"lodash\": \"^4.17.0\" }\n}",
  "manifest_type": "auto",
  "check_advisories": false
}

or

{
  "manifest_url": "https://raw.githubusercontent.com/pallets/flask/main/pyproject.toml",
  "check_advisories": true
}

Output (one dataset record)

{
  "status": "ok",
  "manifest_type": "npm",
  "ecosystem": "npm",
  "component_count": 1,
  "components": [
    {"name": "lodash", "version": "4.17.0", "version_spec": "^4.17.0",
     "pinned": "4.17.0", "ecosystem": "npm", "scope": "required"}
  ],
  "sbom": { "bomFormat": "CycloneDX", "specVersion": "1.5", "components": [ ... ] }
}

Use cases

• Generate a CycloneDX SBOM for a repo from its manifest — for compliance or audit.
• Quick dependency inventory across many ecosystems with one tool.
• Optional vulnerability triage via free OSV.dev advisories (no key, no paid feed).

How it works (deterministic, code-only)

The manifest is read from text or fetched (SSRF-guarded) from a raw URL, the ecosystem is auto-detected or forced, and dependencies are parsed deterministically into a normalized component list + a CycloneDX 1.5 SBOM with PURLs. Advisory enrichment, when enabled, queries the keyless public OSV.dev API (bounded).

Limitations (honest)

• Parses declared manifest dependencies, not a fully resolved lockfile graph.
• OSV advisory lookups require pinned versions and are capped at 50 per run.
• Advisory enrichment is opt-in (check_advisories: true); SBOM-only is the $0 default.