cyclonedx-bom

What it is and what it does

cyclonedx-bom is a command-line tool that reads Python project metadata and generates standardized SBOM documents in CycloneDX format. It works by scanning Python virtual environments, Poetry and Pipenv manifests, pip requirements files, and PDM/uv environments to extract dependency information, then serializes that data according to official CycloneDX specifications and optional namespace taxonomies for Python-specific properties.

The tool is designed for compliance and security workflows where you need a complete, accurate inventory of software components and their versions. It depends on cyclonedx-python-lib for the actual SBOM data structures, packageurl-python for component URLs, pip-requirements-parser for parsing requirements files, and chardet and tomli for encoding and configuration handling. The resulting SBOMs can approach OWASP SCVS Level-2 compliance (external signing required).

Use it for:

• Generate SBOMs for supply-chain security audits and compliance reporting
• Create dependency inventories from Poetry or Pipenv projects for vulnerability scanning
• Export Python virtual environment contents as standardized SBOM for CI/CD pipelines
• Build component catalogs from requirements.txt for license and security analysis
• Integrate SBOM generation into build tools to track software composition over time

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Generates Software Bill of Materials (SBOM) documents in CycloneDX format from Python projects, virtual environments, and dependency manifests (Poetry, Pipenv, requirements.txt, PDM, uv).

Yes. The tool is actively maintained, has no known vulnerabilities, low install friction, and fills a specific compliance need—generating standards-based SBOMs for Python projects. Install it if you need to produce CycloneDX documents for supply-chain security, regulatory compliance, or vulnerability tracking workflows.

Install

cyclonedx-bom on PyPI

pip install cyclonedx-bom

uv add cyclonedx-bom

poetry add cyclonedx-bom

Installing cyclonedx-bom

Before you install

Low install friction with six runtime dependencies; actively maintained with a release 22 days ago and 389 repository stars. Supports Python 3.9 through 3.14.

License in practice

Apache 2.0 permissive license allows use, modification, and distribution with minimal restrictions—suitable for both open-source and proprietary projects.

Quickstart

pip install cyclonedx-bom
cyclonedx-py environment --output-file sbom.json
# or: cyclonedx-py requirements --input requirements.txt --output-file sbom.json

Requires Python >=3.9,<4; the tool is CLI-only and has no public Python API for programmatic use.

Verify before relying

• Whether the tool can validate SBOMs against CycloneDX schema versions beyond what the description implies
• Support status for Python 2.7 in older versions and which versions those are

Package facts

Evidence: cyclonedx_bom-7.3.1-py3-none-any.whl

Keywords: OWASP, CycloneDX, bill-of-materials, BOM, software-bill-of-materials, SBOM, environment, virtualenv, venv, Poetry, Pipenv, requirements, PDM, Conda, SPDX, licenses, PURL, package-url, dependency-graph

Tags

More Software Development packages