cyclonedx-py
Alias for package 'cyclonedx-bom'
Decision gist · record as of 2026-08-14
Yes, if you need to generate SBOMs for Python projects. The tool is actively maintained, has low install friction, and covers the most common Python dependency sources. Verify the license terms before use in proprietary contexts, and confirm it supports your specific package manager or environment setup.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python >=3.9,<4 as stated in the description.
- Low friction installation as a pure Python wheel.
- Actively maintained with recent commits and a stable repository; no notable install concerns.
License · maintenance · safety
(unclear) — License treatment is unclear from the package metadata, though the description excerpt mentions Apache 2.0 terms. Verify the actual license before use in proprietary or restricted contexts.
last release 2024-01-31 (926 days) · last repo commit 2026-08-12 · 389 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 93,724 downloads/mo, #13,366 on PyPI
Alternatives
Verify before relying
pip install cyclonedx-bom
cyclonedx-py environment --output-file sbom.xml
# or: python3 -m cyclonedx_py environment --output-file sbom.xml- Exact license identifier and terms (description mentions Apache 2.0 but metadata shows 'unclear').
- Whether the package exposes a stable public API for programmatic use beyond the CLI.
- Support for additional Python package managers or lock file formats beyond those listed.
What it is and what it does
cyclonedx-py is a command-line tool that generates Software Bill of Materials (SBOM) documents in CycloneDX format from Python projects and environments. It reads from multiple sources—Python virtual environments, Poetry manifests and lockfiles, Pipenv manifests and lockfiles, and pip requirements.txt files—and produces standardized SBOM output that follows official CycloneDX specifications and taxonomies. The tool is designed to be accurate and comprehensive for Python-related projects.
The package wraps the CycloneDX Python library and exposes a stable CLI interface. It does not provide a public Python API; all code is internal and subject to change. The tool aims to produce SBOMs that nearly meet OWASP Software Component Verification Standard Level-2 criteria (signing must be done externally). It is actively maintained and runs on Python >=3.9,<4.
Use it for
- Generate a complete SBOM from a Poetry or Pipenv project for supply-chain security audits.
- Create an SBOM from a Python virtual environment to document all installed dependencies.
- Convert pip requirements.txt files into standardized CycloneDX SBOM format for compliance.
- Produce SBOMs that comply with OWASP SCVS criteria for software component verification.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you need to generate SBOMs for Python projects.
The tool is actively maintained, has low install friction, and covers the most common Python dependency sources. Verify the license terms before use in proprietary contexts, and confirm it supports your specific package manager or environment setup.
Install
cyclonedx-py on PyPI
Before you install
Low friction installation as a pure Python wheel. Actively maintained with recent commits and a stable repository; no notable install concerns.
Requires Python >=3.9,<4 as stated in the description.
License in practice
License treatment is unclear from the package metadata, though the description excerpt mentions Apache 2.0 terms. Verify the actual license before use in proprietary or restricted contexts.
Quickstart
pip install cyclonedx-bom
cyclonedx-py environment --output-file sbom.xml
# or: python3 -m cyclonedx_py environment --output-file sbom.xmlVerify before relying
- Exact license identifier and terms (description mentions Apache 2.0 but metadata shows 'unclear').
- Whether the package exposes a stable public API for programmatic use beyond the CLI.
- Support for additional Python package managers or lock file formats beyond those listed.
Package facts
| License | Not declared unclear |
| Python support | Not specified |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 1 packagecyclonedx-bom |
| Maintenance | Actively maintained 926 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 93,724 / month, #13,366 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
Evidence: cyclonedx_py-1.0.1-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “python sbom generation”
- cyclonedx-pyGenerates Software Bill of Materials (SBOM) documents in CycloneDX…
- spdx-python-modelProvides Python bindings for the SPDX 3 data model, enabling direct…
- cyclonedx-python-libProvides data models, validators, and serialization tools to create,…
Give your agent the search over MCP, or paste the wish link into any chat.
More Build Tools packages
Provides reusable utilities for Python packaging interoperability, including version handling, specifiers, markers, requirements, tags, and metadata parsing according to standards like PEP 440 and PEP 425.
Wraps any iterable to display a real-time progress bar in the terminal or Jupyter notebook, showing iteration count, elapsed time, and estimated time remaining.
pip is the standard installer for Python packages, enabling you to download and install packages from the Python Package Index and other indexes into your Python environment.
Hatchling is a standards-compliant Python build backend that handles packaging, metadata, and distribution of Python projects when configured in a project's pyproject.toml file.
Generates Python gRPC service stubs and message classes from Protocol Buffer definitions, enabling developers to build gRPC clients and servers.
pre-commit is a framework for installing and running git hooks written in any language before commits are made, automating code quality and validation checks across multi-language projects.
Install it if your team needs consistent, automated validation at commit time.
See also cyclonedx-bom · cyclonedx-python-lib · distro2sbom · lib4vex · lib4sbom · pdm · pipenv · spdx-python-model · socketdev · migrate-to-uv