---
id: cyclonedx-bom
version: "7.3.1"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# cyclonedx-bom — CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments

License: permissive · Maintenance: active · Downloads: 2.4M/mo

## What it is and what it does

cyclonedx-bom is a command-line tool that reads Python project metadata and generates standardized SBOM documents in CycloneDX format. It works by scanning Python virtual environments, Poetry and Pipenv manifests, pip requirements files, and PDM/uv environments to extract dependency information, then serializes that data according to official CycloneDX specifications and optional namespace taxonomies for Python-specific properties.

The tool is designed for compliance and security workflows where you need a complete, accurate inventory of software components and their versions. It depends on cyclonedx-python-lib for the actual SBOM data structures, packageurl-python for component URLs, pip-requirements-parser for parsing requirements files, and chardet and tomli for encoding and configuration handling. The resulting SBOMs can approach OWASP SCVS Level-2 compliance (external signing required).

Use it for:

- Generate SBOMs for supply-chain security audits and compliance reporting
- Create dependency inventories from Poetry or Pipenv projects for vulnerability scanning
- Export Python virtual environment contents as standardized SBOM for CI/CD pipelines
- Build component catalogs from requirements.txt for license and security analysis
- Integrate SBOM generation into build tools to track software composition over time

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Generates Software Bill of Materials (SBOM) documents in CycloneDX format from Python projects, virtual environments, and dependency manifests (Poetry, Pipenv, requirements.txt, PDM, uv).

Yes. The tool is actively maintained, has no known vulnerabilities, low install friction, and fills a specific compliance need—generating standards-based SBOMs for Python projects. Install it if you need to produce CycloneDX documents for supply-chain security, regulatory compliance, or vulnerability tracking workflows.

## Install

pip install cyclonedx-bom
uv add cyclonedx-bom
poetry add cyclonedx-bom

## Installing cyclonedx-bom

Before you install: Low install friction with six runtime dependencies; actively maintained with a release 22 days ago and 389 repository stars. Supports Python 3.9 through 3.14.

License in practice: Apache 2.0 permissive license allows use, modification, and distribution with minimal restrictions—suitable for both open-source and proprietary projects.

Quickstart:

pip install cyclonedx-bom
cyclonedx-py environment --output-file sbom.json
# or: cyclonedx-py requirements --input requirements.txt --output-file sbom.json

Requires Python >=3.9,<4; the tool is CLI-only and has no public Python API for programmatic use.

Verify before relying:

- Whether the tool can validate SBOMs against CycloneDX schema versions beyond what the description implies
- Support status for Python 2.7 in older versions and which versions those are

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 2.4M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

python sbom generator, cyclonedx bill of materials, dependency inventory tool, python environment bom, software composition analysis, owasp cyclonedx, python package manifest, sbom-generation, supply-chain-security, compliance

[View on SkillFed](https://skillfed.io/packages/cyclonedx-bom) · [View on PyPI](https://pypi.org/project/cyclonedx-bom/)