Free tool
Create an SBOM from your source code
Drop your project folder and get a CycloneDX or SPDX software bill of materials in seconds. The analysis runs in this page - your code never leaves your computer.
Drop a project folder or a .zip here
Lock files, manifests and vendored C/C++ libraries are recognised. Nothing is uploaded.
Private by design. Your files are read by JavaScript in this browser tab. The page is not allowed to send data anywhere (Content-Security-Policy connect-src 'none') - check it in your browser's developer tools, or disconnect from the network before you drop the folder.
Your SBOM is ready
No known dependency files were found. Supported files are listed below.
| Component | Version | Type | Found in |
|---|
Next step: upload the file to a release in Kernwatch and get an alert when one of these components gets a known or actively exploited vulnerability. Monitor it for free →
What it reads
The generator reads the files your package managers already write. Lock files give exact versions and the whole dependency tree; a manifest alone gives only the direct dependencies.
| Ecosystem | Files |
|---|---|
| JavaScript / TypeScript | package-lock.json, npm-shrinkwrap.json, yarn.lock (v1, berry), pnpm-lock.yaml, bun.lock, deno.lock, deno.json, package.json |
| Python | uv.lock, poetry.lock, Pipfile.lock, requirements*.txt, pyproject.toml, environment.yml |
| Go | go.mod |
| Rust | Cargo.lock, Cargo.toml |
| Java / Kotlin / Scala | pom.xml, gradle.lockfile, libs.versions.toml, build.gradle(.kts), build.sbt |
| .NET | packages.lock.json, *.csproj, packages.config, Directory.Packages.props |
| PHP | composer.lock, composer.json |
| Ruby | Gemfile.lock |
| Swift / iOS | Package.resolved, Package.swift, Podfile.lock, Cartfile.resolved |
| Dart / Flutter | pubspec.lock, pubspec.yaml |
| Elixir / Erlang | mix.lock, rebar.lock |
| Haskell, Julia, R, Lua, Zig, OCaml, Perl | cabal.project.freeze, stack.yaml.lock, *.cabal, Manifest.toml, Project.toml, renv.lock, DESCRIPTION, *.rockspec, build.zig.zon, *.opam, cpanfile |
| C/C++ package managers | conan.lock, conanfile.txt, conanfile.py, vcpkg.json, meson .wrap, MODULE.bazel |
| Embedded | platformio.ini, idf_component.yml, dependencies.lock (ESP-IDF), west.yml (Zephyr), library.properties, library.json |
| Nix | flake.lock |
| C/C++ (vendored) | headers of 60 common libraries (zlib, OpenSSL, mbedTLS, wolfSSL, SQLite, lwIP, FreeRTOS, cJSON, curl, fmt, littlefs, ...) recognised by their version macros; .gitmodules |
| Build files (no lock file) | CMake (find_package, pkg_check_modules, target_link_libraries, FetchContent, CPM), Makefile -l flags, qmake, meson, autoconf; well-known #include headers. Listed without versions. |
| Web pages | CDN links (unpkg, jsDelivr, cdnjs, esm.sh, code.jquery.com, ...) and bundled jQuery, Bootstrap, Vue, pdf.js and other libraries recognised by their banner |
| Containers | Dockerfile base images (FROM) |
Libraries copied into the project are found too: every folder in third_party/, vendor/, external/, deps/ and every name-1.2.3 folder, named and versioned from its own files. Folders such as node_modules, .git, target, build trees and virtual environments are skipped, and test, docs and example projects count as development dependencies. Nothing is executed and no package registry is contacted, so the result depends only on the files in the folder.
Desktop and CI tool
The same generator as a single program for Windows, macOS and Linux - for large repositories, scripts and build pipelines. It gives the same result as this page.
Source code
Everything both tools are built from: the JavaScript of this page, the C++ program, the rules and the tests. Apache-2.0.
The binaries are not code-signed yet. Compare the SHA-256 checksum after downloading. Windows SmartScreen may ask you to confirm (More info > Run anyway); on macOS run xattr -d com.apple.quarantine kernwatch-sbom once. SHA256SUMS · Version 0.2.0
Usage
kernwatch-sbom ./my-product --name my-product --version 2.4.0 -o my-product.cdx.json
kernwatch-sbom ./my-product --format spdx -o my-product.spdx.json
kernwatch-sbom --helpIn your build pipeline
Generate the SBOM on every release build and send it straight to your Kernwatch workspace with an API key (Settings > API keys):
# GitHub Actions step (secret KERNWATCH_API_KEY = a key with the SBOM upload scope)
- name: SBOM to Kernwatch
env:
KERNWATCH_API_KEY: ${{ secrets.KERNWATCH_API_KEY }}
run: |
curl -fsSLo kernwatch-sbom https://kernwatch.com/downloads/kernwatch-sbom/0.2.0/kernwatch-sbom-0.2.0-linux-x86_64
chmod +x kernwatch-sbom
./kernwatch-sbom . --name my-product --version "$GITHUB_REF_NAME" -o sbom.cdx.json \
--upload https://kernwatch.com/rest/v1/cra/sbom/kernwatch_dbThe generator is open source (Apache-2.0). Source code (.zip)
Questions
Is my source code uploaded?
No. In the browser the files are read by JavaScript in your own tab, and the page's Content-Security-Policy forbids it to send data. The desktop tool works offline; it only connects to the network when you ask it to upload the SBOM to Kernwatch.
Which SBOM formats does it create?
CycloneDX 1.6 JSON and SPDX 2.3 JSON, the two widely used machine-readable formats. Both validate against the official schemas and can be imported by Kernwatch and other SBOM tools.
Is this SBOM enough for the Cyber Resilience Act?
The CRA asks for an SBOM in a commonly used, machine-readable format covering at least the top-level dependencies, kept with the technical documentation. A lock-file based SBOM covers that and more. The CRA also requires you to handle the vulnerabilities that later appear in those components - that is what Kernwatch monitors.
Why do some components have no exact version?
Because the folder has only a manifest (such as package.json, pom.xml or a .csproj) without a lock file. The generator never guesses: it records the declared range and says so. Commit your lock file, or enable Gradle dependency locking, to get exact versions and transitive dependencies.
Does it scan binaries or firmware images?
No. It reads source trees: lock files, manifests and the headers of vendored C/C++ libraries. Declare libraries that you only ship as binaries in your Kernwatch release by hand.
Claim your free Kernwatch account
The free plan covers one product and needs no credit card. Paid plans add more products, users and the full reporting workflow - upgrade whenever you need it.
- Free plan for 1 product
- No credit card
37 days since CRA reporting started · 419 days until all CRA requirements apply