---
id: cyclonedx-py
version: "1.0.1"
license: unclear
license_treatment: unclear
maintenance: active
---

# cyclonedx-py — Alias for package 'cyclonedx-bom'

License: unclear · Maintenance: active · Downloads: 93.7K/mo

## What it is and what it does

cyclonedx-py is a command-line tool that generates Software Bill of Materials (SBOM) documents in CycloneDX format from Python projects and environments. It reads from multiple sources—Python virtual environments, Poetry manifests and lockfiles, Pipenv manifests and lockfiles, and pip requirements.txt files—and produces standardized SBOM output that follows official CycloneDX specifications and taxonomies. The tool is designed to be accurate and comprehensive for Python-related projects.

The package wraps the CycloneDX Python library and exposes a stable CLI interface. It does not provide a public Python API; all code is internal and subject to change. The tool aims to produce SBOMs that nearly meet OWASP Software Component Verification Standard Level-2 criteria (signing must be done externally). It is actively maintained and runs on Python >=3.9,<4.

Use it for:

- Generate a complete SBOM from a Poetry or Pipenv project for supply-chain security audits.
- Create an SBOM from a Python virtual environment to document all installed dependencies.
- Convert pip requirements.txt files into standardized CycloneDX SBOM format for compliance.
- Produce SBOMs that comply with OWASP SCVS criteria for software component verification.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Generates Software Bill of Materials (SBOM) documents in CycloneDX format from Python projects, virtual environments, and package managers like Poetry, Pipenv, and pip.

Yes, if you need to generate SBOMs for Python projects. The tool is actively maintained, has low install friction, and covers the most common Python dependency sources. Verify the license terms before use in proprietary contexts, and confirm it supports your specific package manager or environment setup.

## Install

pip install cyclonedx-py
uv add cyclonedx-py
poetry add cyclonedx-py

## Installing cyclonedx-py

Before you install: Low friction installation as a pure Python wheel. Actively maintained with recent commits and a stable repository; no notable install concerns.

License in practice: License treatment is unclear from the package metadata, though the description excerpt mentions Apache 2.0 terms. Verify the actual license before use in proprietary or restricted contexts.

Quickstart:

pip install cyclonedx-bom
cyclonedx-py environment --output-file sbom.xml
# or: python3 -m cyclonedx_py environment --output-file sbom.xml

Requires Python >=3.9,<4 as stated in the description.

Verify before relying:

- Exact license identifier and terms (description mentions Apache 2.0 but metadata shows 'unclear').
- Whether the package exposes a stable public API for programmatic use beyond the CLI.
- Support for additional Python package managers or lock file formats beyond those listed.

## Package facts

- License: not declared (unclear)
- Python support: unspecified
- Install friction: low
- Maintenance: active
- Downloads: 93.7K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

python sbom generation, cyclonedx sbom tool, software bill of materials python, dependency inventory generator, python environment sbom, poetry pipenv requirements sbom, owasp cyclonedx python, sbom-generation, supply-chain-security, compliance

[View on SkillFed](https://skillfed.io/packages/cyclonedx-py) · [View on PyPI](https://pypi.org/project/cyclonedx-py/)