bomlens

Project Overview

BomLens is a local-first SBOM generator and open-source risk assessor. It produces a CycloneDX SBOM, an open-source notice, and a security and license risk report for a single project in seconds — from source code, a container, a binary, firmware, an SBOM you received, or a HuggingFace AI model.

Key Features

• Generate SBOM: Scan your source code, container image, or binary to get a CycloneDX SBOM, open-source notice, and security report
• Assess Open-Source Risk: Analyze a supplier's finished SBOM or firmware binary, reporting licenses and known vulnerabilities with remediation deadlines
• Multiple Inputs: Source folder, GitHub URL, ZIP archive, Docker image, binary or RootFS, existing SBOM, Yocto build directory, firmware, HuggingFace AI model, and more
• Multiple Languages: Java, Python, Node.js, Ruby, PHP, Rust, Go, .NET, Swift, C/C++, and more
• CLI or Web UI: Command-line and browser interfaces, no SaaS required

Target Audience

• Developers and security engineers who need to generate SBOMs for software supply chain security
• Procurement and compliance teams who need to assess the risk of third-party software components

Quick Start

1. Download the installer for Windows or macOS from Releases
2. Or use the CLI tool
3. Scan your project: specify a source code path, container image, or binary
4. Get the CycloneDX SBOM and risk report

Core Advantages

• Local-first with no data upload for privacy
• Supports a wide range of input types and programming languages
• Actively developed by SK Telecom's open source program office with weekly updates
• Online demo available to view scan results without installation

System Requirements

• OS: Windows, macOS
• Architectures: Not explicitly listed