Skip to content
SPECIFICTION
Get listed

SBOM Manager

pypi.org

Free plan Linux
Visit pypi.org
Spec score 7.2 #18 of 22 in SBOM Management Software

What it is

SBOM Manager is a free, MIT-licensed command-line tool for maintaining collections of Software Bills of Materials. It records components used in releases or builds and lets users check whether particular components and versions appear. Search tools include module lookup, project filtering, repository listings, and update-history views. Inputs can be SPDX 2.3 Tag/Value or JSON, CycloneDX 1.4 XML or JSON, CSV, and directory listings. Results can print to the console or go to a file in console or CSV formats. Repository archives can be exported and imported for restoration. The project describes continuous-integration and security-audit use. Vulnerability scanning requires a separately configured scanner that accepts an SPDX Tag/Value file; an example uses cve-bin-tool. The Linux tool requires Python 3.7 or later and installs with pip install sbom-manager. It cannot judge SBOM validity or completeness, or decide whether vulnerabilities require fixes.

Spec sheet

Purpose
SBOM Manager manages a collection of Software Bills of Materials (SBOMs) and supports SPDX and CycloneDX formats.Read 7 Oct 2026 · pypi.org
Support
Bug reports and feature requests can be submitted through GitHub Issues.Read 7 Oct 2026 · github.com
License
The project is licensed under the MIT License.Read 7 Oct 2026 · pypi.org
Data portability
The command line supports exporting a repository archive and importing it to restore a repository.Read 7 Oct 2026 · pypi.org
Example integration
The configuration example names cve-bin-tool as the vulnerability-scanning application.Read 7 Oct 2026 · pypi.org
Input formats
It supports SPDX 2.3 Tag/Value or JSON, CycloneDX 1.4 XML or JSON, CSV, and directory listings.Read 7 Oct 2026 · pypi.org
Installation
The project documents installation with pip install sbom-manager and requires Python 3.7 or later.Read 7 Oct 2026 · pypi.org
Intended use
The project describes use as part of continuous integration and for security audit needs.Read 7 Oct 2026 · pypi.org
Output
Results can be printed to the console or written to a file, with console or CSV output formats.Read 7 Oct 2026 · pypi.org
Queries
Users can search for modules, filter by project, list repository contents, and view update history.Read 7 Oct 2026 · pypi.org
Scanning limitation
The project says deciding whether reported vulnerabilities need fixing is beyond the tool’s capability.Read 7 Oct 2026 · pypi.org
Security limitation
The tool cannot determine whether an SBOM is valid or complete, so users are advised to check the quality of input data.Read 7 Oct 2026 · pypi.org
Vulnerability scanning
Scanning requires an external vulnerability scanner that accepts an SPDX Tag/Value SBOM file, configured by the user.Read 7 Oct 2026 · pypi.org
Workflow
It can maintain records of components in software releases or builds and query whether specific components and versions were used.Read 7 Oct 2026 · pypi.org

Plans and prices

SBOM Manager Free Free, open source tool; MIT licensed Read 7 Oct 2026 · pypi.org

Every SBOM Manager plan and price →

Strong points and limits

Strong points

  • Free and MIT licensed
  • Supports SPDX and CycloneDX formats
  • Imports CSV and directory listings
  • Exports and restores repository archives
  • Runs from the command line

Limits

  • Linux platform only
  • Requires an external vulnerability scanner
  • Cannot validate SBOM completeness
  • Cannot decide which vulnerabilities need fixing

Who it suits

It suits Linux users managing SBOM records in build workflows or security audits. It is intended for people comfortable configuring an external vulnerability scanner.

Verdict

SBOM Manager provides portable SBOM collection and querying with broad input support. Users must verify input quality and make remediation decisions outside the tool.

Where Specifiction places it

Alternatives to SBOM ManagerAll alternatives →