mcp-sbom-server

Performs scans and generates Software Bill of Materials (SBOM) in CycloneDX format, while identifying vulnerabilities in software dependencies. Facilitates integration with MCP clients for efficient scanning and reporting.

Author

gkhays

No License

Quick Info

GitHub Stars 2

Weekly Downloads 0

Tools 1

Last Updated 2026-02-19

Actions

View on GitHub

MCP SBOM Server

MCP server to perform a Trivy scan and produce an SBOM in CycloneDX format.

Installation

Prerequisites

Install the following.

MCP Clients

Configuration

"mcpServers": {
        "mcp-sbom": {
            "command": "uv",
            "args": [
                "--directory",
                "/path/to/mcp-sbom",
                "run",
                "mcp-sbom"
            ]
        }
    }

Building

[!NOTE] This project employs uv.

Synchronize dependencies and update the lockfile.

uv sync

Debugging

MCP Inspector

Use MCP Inspector.

Launch the MCP Inspector as follows:

npx @modelcontextprotocol/inspector uv --directory /path/to/mcp-sbom run mcp-sbom

Windows

When running on Windows, use paths of the style:

C:/Users/gkh/src/mcp-sbom-server/src/mcp_sbom