SBOM tools compared

Who this is for

This page is for teams that need SBOMs, for the Cyber Resilience Act, a customer questionnaire or their own vulnerability work, and are sorting through the options. We build CRACI, so weigh that in. Every claim about another tool comes from its own documentation, listed under Sources, and each tool has a longer CRACI vs X page.

How to choose

• Do you need to produce SBOMs, manage them, or both? A generator gives you a file. A manager gives you a place to keep files from many products and suppliers, enrich them and act on them. Managers depend on what generators feed them.
• Is the software yours or bought? For your own builds you control the input. For supplier software you need intake, validation and sometimes binary analysis.
• How sure do you need to be that the list is complete? Generators read files after the fact, and they disagree more than most people expect (see below).
• Which CI do you run, and must it be self-hosted? Open-source generators run anywhere. CRACI supports GitHub Actions on Linux, as a managed service.

SBOM generators

This compares what each generator does, not how many components it returns.

Syft

Syft is Anchore's free, Apache-2.0 generator for container images and filesystems. It recognizes dozens of package types, writes CycloneDX, SPDX and Syft JSON, and can create signed in-toto SBOM attestations. Grype, its companion, matches the SBOM against vulnerabilities. Best for images and for any pipeline that needs a free generator. Watch out: catalogers are chosen by scan type, so on an installed express checkout one flag decides whether npm packages appear in the result at all. CRACI vs Syft and Grype

Trivy

Trivy, from Aqua Security, is a versatile Apache-2.0 scanner for images, filesystems, repositories, VM images and Kubernetes. It finds vulnerabilities, IaC misconfigurations, secrets and licenses, and writes CycloneDX or SPDX as a side effect. Best for teams that want one free binary for many security checks. Watch out: for a repository it reads lock files, so express 5.2.1 (no lockfile) and claude-code (no manifest) give it nothing to read, exactly as documented. CRACI vs Trivy

cdxgen

cdxgen is an OWASP CycloneDX project that creates CycloneDX BOMs from source and container images, under Apache-2.0. Best for teams standardized on CycloneDX that want a generator from the format's own community. Watch out: like the other scanners, it can only report what the files in front of it declare. CRACI vs a DIY SBOM stack

Microsoft SBOM Tool

The Microsoft SBOM Tool is an MIT-licensed generator that writes SPDX. It expects a build drop folder, a package name, a version and a supplier on the command line, which makes it a post-build step. Best for teams that want SPDX for a build output they already package. Watch out: pointed at repositories as committed, rather than at a build drop, it has almost nothing to describe. Because it takes a supplier on the command line, it can fill the supplier field. CRACI vs a DIY SBOM stack

GitHub dependency graph export

GitHub's dependency graph summarizes a repository's manifest and lock files, plus anything sent through the dependency submission API, and exports as SPDX from the UI or REST API. It feeds Dependabot alerts and is included in every GitHub plan. Best for teams already on GitHub who need a quick SBOM. Watch out: it reflects the default branch rather than a pinned commit, and it is built from what GitHub knows about the repository rather than from files a scanner reads. CRACI vs GitHub Advanced Security

What a scanned SBOM depends on

Point the generators above at the same repository and they return different lists. These are the patterns the tools' own documentation predicts:

• No component is found by every tool. Each generator decides for itself what counts as a component and which files to trust, so one repository gives each of them a different list.
• No lockfile, no dependencies. Express 5.2.1 commits none, so a generator that resolves dependencies from lock files reports none of its npm dependencies and returns whatever else it recognizes.
• No manifest at all. The claude-code repository has no manifest or lockfile, so what each tool returns is assembled from other file types and says more about the tool than about the project.
• Thin metadata. The supplier field often comes out empty, because most generators have no source for it.

None of these tools is broken. Each reads the files in front of it, as designed. The lesson is that a scanned SBOM depends on the tool, its settings and whether anyone installed dependencies first.

SBOM managers

Anchore Enterprise

Anchore Enterprise builds on Syft and Grype and adds what large organizations need: container, source and filesystem SBOMs, imported SBOMs validated for schema correctness, continuous rescanning without the original artifact, and policy packs for FedRAMP, NIST, CIS, PCI DSS and CMMC. It deploys on Kubernetes, Docker Compose or air-gapped. Best for container fleets across several CI systems and for government work. Watch out: its SBOMs still describe what a scanner found, and pricing is by quote. CRACI vs Anchore

FOSSA

FOSSA started with license compliance: full-text license detection, policies and attribution notices. It generates and imports SPDX and CycloneDX SBOMs, can add VDR or VEX statements, checks imports against NTIA and FDA minimum elements, and shares SBOMs through a portal on Enterprise. The Free plan covers 5 projects. Best for teams whose first concern is license risk. Watch out: its CLI queries your build tools when a working build is available and infers from source when not, and binary and snippet scanning are add-ons. CRACI vs FOSSA

Cybeats SBOM Studio

SBOM Studio calls itself "the SBOM system of record." It imports and exports SPDX 2.2 to 3.0.1 and CycloneDX 1.2 to 1.7, scores SBOM quality before import, matches every component continuously, and shares SBOM and VEX data with customers, including over the Transparency Exchange API. Best for product security teams in ICS, medical devices, telecom and automotive running an SBOM program. Watch out: it manages SBOMs rather than producing them, and a quality score confirms format, not what the generator missed. CRACI vs Cybeats

Manifest

Manifest collects, enriches and shares SBOMs across your products, your vendors and your AI models. Vendors upload through a secure portal, and when they provide none, Manifest can analyze the binary and generate one. It supports SPDX, CycloneDX and VEX and maps to FDA guidance, NIST 800-218 and UNECE R155. Best for organizations whose main exposure is software they buy. Watch out: its GitHub Action generates first-party SBOMs with Syft by default. CRACI vs Manifest

OWASP Dependency-Track

Dependency-Track is an Apache 2.0 platform that tracks components across every version of every application, pulls vulnerability data from sources including NVD and GitHub Advisories, applies security, license and operational policies, and consumes and produces CycloneDX VEX. Pipelines upload SBOMs through its API. Best for teams that want a transparent, self-hosted analysis platform. Watch out: it does not generate SBOMs, and you run it yourself (the API server needs at least 2 GB of RAM and 2 CPU cores). CRACI for Dependency-Track users

How CRACI fits

CRACI is neither a scanner nor a manager. It is a recorder. Your GitHub Actions jobs run on CRACI runners (change runs-on to craci), and a package-aware proxy records what each job fetches from npm, PyPI, RubyGems, Cargo, Go, Nix and OCI sources, plus OS and download sources. Packages restored from a CI cache carry their evidence forward. The SBOM, in CycloneDX or SPDX, includes the transitive dependencies the build used, and states its completeness per job and per cache: Complete, Complete with connections, Incomplete, Unavailable or Not recorded.

After the build, CRACI keeps re-evaluating monitored SBOMs, aggregates vulnerabilities across builds and repositories, signs provenance that links each artifact to its build, and exports reports in PDF, HTML, CSV, Excel and JSON. It automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process.

So CRACI does the job of a generator and a manager together, for the software you build. It is not the right choice when:

• you need SBOMs for images or software you did not build (use a generator such as Syft or Trivy),
• you need VEX, license policy or portfolio policy (use a manager),
• your pipelines run outside GitHub Actions, on Windows or macOS, or must be self-hosted.

See also SCA tools compared, AI-generated SBOMs vs build-time SBOMs, and build-time SBOM generation.