AutoBOM

A Node.js/TypeScript microservice engine that orchestrates existing open-source tools to generate, validate, and surface Software Bills of Materials (SBOMs) for mixed-language workspaces (Node/React/Angular, Python, Go, Rust, Java, Ruby).

AutoBOM is a thin, production-hardened orchestration layer — it does not reimplement SBOM generation. It drives:

• syft — SBOM generation
• cyclonedx-cli — schema validation
• OWASP Dependency-Track — dashboard rendering (optional)

Pipeline

analyze → lockfile guard → generate (syft) → validate (cyclonedx-cli) → surface

1. Dynamic Target Analyzer — detects ecosystems by manifest/lockfile signatures.
2. Lockfile Enforcement Guard — warns on, or auto-generates, missing lockfiles so transitive dependencies are captured (npm shrinkwrap, pip-compile, go mod download).
3. Core Generation Engine — runs syft and emits CycloneDX JSON (1.5 or 1.6).
4. Validation Gate — runs cyclonedx-cli validate; the run fails closed on schema errors.
5. Dashboard Integration Layer
   • A ready-to-send Dependency-Track PUT /api/v1/bom request (or direct upload).
   • A client-side dependency tree helper that structures components into a multi-tier, expandable list for a custom UI.

Prerequisites

• Node.js >= 20
• syft on PATH (releases)
• cyclonedx-cli on PATH (releases) — tested against v0.32.0
• (optional, for --enforce-lockfiles) npm, pip-compile (pip-tools), or go

Windows note: the release ships cyclonedx-win-x64.exe; rename it to cyclonedx-cli.exe and place it on PATH. AutoBOM invokes cyclonedx-cli validate --input-format json --input-file <path> --fail-on-errors.

Install & build

npm install
npm run build

CLI

# Inspect a workspace
npx autobom analyze ./path/to/workspace

# Full pipeline, persist the validated BOM
npx autobom generate ./path/to/workspace --spec 1.6 --out bom.cdx.json --tree

# Auto-generate missing lockfiles first
npx autobom generate ./path/to/workspace --enforce-lockfiles

Exit code is 1 if validation fails (unless --no-validate).

See docs/CLI.md for the full command reference (all flags, exit codes, npm link setup, and monorepo usage).

HTTP service

npm start            # listens on :8080 (PORT env to override)

| Method | Route | Body | |--------|------------|--------------------------------------------------------| | GET | /health | — | | POST | /analyze | { "workspacePath": "..." } | | POST | /sbom | { "workspacePath": "...", "specVersion": "1.6", ... }| | POST | /tree | { "bom": <CycloneDX JSON> } |

POST /sbom options: specVersion (1.5/1.6), lockfileMode (warn/enforce), requireValid, buildTree, includeBom, and dependencyTrack ({ baseUrl, apiKey, projectName, projectVersion, autoCreate }).

MCP server

AutoBOM ships a Model Context Protocol server (stdio transport) so AI clients like Claude Code can drive SBOM generation directly. Build first (npm run build), then run:

npm run mcp          # node dist/mcp.js  (stdio)

Tools exposed: analyze_workspace, generate_sbom, validate_sbom, build_dependency_tree, upload_to_dependency_track.

The server auto-adds the bundled ./.tools dir (from scripts/bootstrap) to its PATH so it finds syft/cyclonedx-cli without extra configuration.

Claude Code: this repo includes a project-scoped .mcp.json, so opening the workspace registers the autobom server automatically (approve it when prompted). To register elsewhere:

claude mcp add autobom -- node /abs/path/to/autobom/dist/mcp.js

Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "autobom": { "command": "node", "args": ["C:/MyProjects/autobom/dist/mcp.js"] }
  }
}

Library

import { runPipeline, buildDependencyTree } from "autobom";

const result = await runPipeline("./workspace", {
  specVersion: "1.6",
  lockfileMode: "enforce",
  dependencyTrack: {
    baseUrl: "https://dtrack.example.com",
    apiKey: process.env.DT_API_KEY!,
    projectName: "my-app",
    projectVersion: "1.0.0",
  },
});

console.log(result.validation.valid, result.tree?.totalComponents);

Errors

Every failure is an AutoBomError with a stable code (WORKSPACE_NOT_FOUND, NO_MANIFEST_DETECTED, BINARY_NOT_FOUND, SCANNER_FAILED, VALIDATION_FAILED, DTRACK_UPLOAD_FAILED, INTERNAL). All logs are prefixed [AutoBOM]. Set AUTOBOM_LOG_LEVEL=debug for verbose output.

Test

npm test