Is io.github.mcpsbom/sbom-mcp safe to use?

io.github.mcpsbom/sbom-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.

How do I install io.github.mcpsbom/sbom-mcp?

io.github.mcpsbom/sbom-mcp can be installed by cloning its GitHub repository and following the setup instructions in the README.

What can io.github.mcpsbom/sbom-mcp do?

io.github.mcpsbom/sbom-mcp provides 4 tools: sbomapp_generateSbomFromWorkspace, generate_sbom, scan_vulnerabilities, analyze_dependencies. See the full tools list on the server page for descriptions and parameters.

What AI clients work with io.github.mcpsbom/sbom-mcp?

io.github.mcpsbom/sbom-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.

Is io.github.mcpsbom/sbom-mcp actively maintained?

io.github.mcpsbom/sbom-mcp is recently maintained — last commit was 81 days ago.

io.github.mcpsbom/sbom-mcp

Generate SBOMs, scan vulnerabilities, and analyze dependencies from local projects or Git repos.

4 tools GitHub

No known CVEs

No license

Maintained

Last commit 81d ago

Works with most clients

Transport: stdio, sse, http

4 tools · ~214 tok

Grade A · 0.1% of 200K ctx

Edit this pageView history

Security DevOps

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-mcpsbom-sbom-mcp": {
      "command": "<see-readme>",
      "args": []
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-mcpsbom-sbom-mcp)](https://mcppedia.org/s/io-github-mcpsbom-sbom-mcp)

Read me

What io.github.mcpsbom/sbom-mcp does

SBOM MCP Server - SBOMApp MCP Server brings software supplychain security assistant inside VS Code. With a simple natural language prompt, developers can instantly generate SBOMs (SPDX/CycloneDX), scan for CVEs, Verify Licence Compliance, and get actionable remediation guidance.

Test This Server

No automated test available for this server. Check the GitHub README for setup instructions.

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

66/100across 5 weighted dimensions

How we score →

0255075100

−34

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

No package registry to scan.

Inventory

Tools (4)

Click any tool to inspect its schema.

~214 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.mcpsbom/sbom-mcp safe to use?: io.github.mcpsbom/sbom-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.mcpsbom/sbom-mcp?: io.github.mcpsbom/sbom-mcp can be installed by cloning its GitHub repository and following the setup instructions in the README.
What can io.github.mcpsbom/sbom-mcp do?: io.github.mcpsbom/sbom-mcp provides 4 tools: sbomapp_generateSbomFromWorkspace, generate_sbom, scan_vulnerabilities, analyze_dependencies. See the full tools list on the server page for descriptions and parameters.
What AI clients work with io.github.mcpsbom/sbom-mcp?: io.github.mcpsbom/sbom-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is io.github.mcpsbom/sbom-mcp actively maintained?: io.github.mcpsbom/sbom-mcp is recently maintained — last commit was 81 days ago.

Similar servers

Others in security / devops

View all →

Mcp Gitlab96

MCP server for using the GitLab API

1.5k 12

Evil Mcp Server93

An evil MCP server used for redteam testing

30 1

Mcp Gitlab Server92

Enhanced MCP server for GitLab: group projects listing and activity tracking

50 2

Ida Pro Mcp92

AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.

8.7k 3

MCP Security Weekly

Get CVE alerts and security updates for io.github.mcpsbom/sbom-mcp and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Security DevOps

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-mcpsbom-sbom-mcp": {
      "command": "<see-readme>",
      "args": []
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-mcpsbom-sbom-mcp)](https://mcppedia.org/s/io-github-mcpsbom-sbom-mcp)

Read me

What io.github.mcpsbom/sbom-mcp does

Test This Server

No automated test available for this server. Check the GitHub README for setup instructions.

README

SBOM for VS Code by SBOMApp!

“AI wrote the code – now audit what’s inside”

No switching tools, no manual scripts, everything happens right inside your editor, keeping you fast, secure, and focused.

Why teams choose SBOMApp MCP:

Endtoend visibility: Build complete SBOMs (including transitive deps) from local workspaces or Git repos, then attach them to builds and releases.

Actionable security: Run vulnerability scans, drill into CVE details, and get fix versions and upgrade paths.

License clarity: Identify copyleft and other risky licenses early with auditfriendly summaries.

Copilot + MCP native: Works naturally in Agent Mode, so prompts like “generate sbom”, “scan vulnerabilities” 

Frictionless onboarding: Start with a 7day free trial or connect your enterprise server using secure tokens stored by VS Code.

Designed for securityminded engineering orgs: Whether you’re shipping regulated software, hardening your SDLC, or preparing for customer SBOM requests, SBOMApp MCP delivers the SBOM, CVE, and license insights your teams need

Absolute Privacy Guarantee!

We don’t store your code, your SBOMs, your dependencies, or any project data — ever. Only your email (for free trial) and API token are stored securely. Everything else stays completely on your machine.

SBOMApp MCP Server

Connect to a remote SBOM MCP Server to perform software bill of materials analysis, vulnerability scanning, opensource license details and dependency management.

Quick Start Guide

Step 1: Install the Extension

Open VS Code
Go to Extensions (Ctrl+Shift+X or Cmd+Shift+X on Mac)
Search for "SBOMApp MCP Server"
Click Install

Or install directly from the VS Code Marketplace

Step 2: Free Trial - Get Started Instantly!

New users get a FREE 90-day trial with 100 Tokens - no credit card required!

Automatic Trial Registration:

Install the extension
On first launch, you'll be prompted to start your free trial
Enter your email address
Your API key is automatically configured - you're ready to go!

Simple steps to Activate Trial!

prerequisites : Visual Studio Code should be Installed with langauage Models enabled.

Click on the SBOM MCP status bar!
Click on the start free trial option,
Click on th start free trial popup,
Enter your official email-id & click Enter,
After sucessful Registration, you will get the trial activation notification!
Reload the Window using the command "CTRL+SHIFT+P" or click "Command Palette" and Select "Developer:Reload Window" to Refresh the MCP Server!

Trial Features:

Feature	Trial
Validity	90 days
Token Requests	100 tokens
SBOM Generation	yes
Vulnerability Scanning	yes

Upgrade to Pro:

When your trial expires or tokens are exhausted, upgrade at: https://payment.sbomapp.com or https://sbomapp.com

Manual Configuration (Enterprise Users):

If you have a license key from your administrator:

Press Ctrl+Shift+P → "SBOMApp: Configure Remote Server"
Enter your Server URL: https://mcp.sbomapp.com/mcp
Enter your API Key

Step 3: Test the Connection

Press Ctrl+Shift+P again
Type "SBOMApp: Test Connection" and press Enter
You should see a success message with available tools count

Step 4: Restart the VS code.

Mandatory step! Once credentials and connections are tested, Kindly restart the VS Code.

Step 5: Start Using "@sbomapp" in chat box

Once

... View full README on GitHub

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

66/100across 5 weighted dimensions

How we score →

0255075100

−34

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

No package registry to scan.

Inventory

Tools (4)

Click any tool to inspect its schema.

~214 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.mcpsbom/sbom-mcp safe to use?: io.github.mcpsbom/sbom-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.mcpsbom/sbom-mcp?: io.github.mcpsbom/sbom-mcp can be installed by cloning its GitHub repository and following the setup instructions in the README.
What can io.github.mcpsbom/sbom-mcp do?: io.github.mcpsbom/sbom-mcp provides 4 tools: sbomapp_generateSbomFromWorkspace, generate_sbom, scan_vulnerabilities, analyze_dependencies. See the full tools list on the server page for descriptions and parameters.
What AI clients work with io.github.mcpsbom/sbom-mcp?: io.github.mcpsbom/sbom-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is io.github.mcpsbom/sbom-mcp actively maintained?: io.github.mcpsbom/sbom-mcp is recently maintained — last commit was 81 days ago.