CheckOps home

Tools directory

C

CheckOps

cdxgen

cdxgen is an Apache-2.0 CycloneDX SBOM generator for source code, container images and many language ecosystems, used to produce bills of materials in CI.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

cdxgen creates CycloneDX bills of materials (BOMs) for projects from source and container images. Its README describes support for many languages and package formats, and the project now lives in its own cdxgen organisation after starting under CycloneDX.

It reads lock files and manifests for ecosystems such as npm, Python, Java, Go, .NET, Rust, PHP and Ruby, inspects container images, and can also generate other BOM types such as SaaSBOM and CBOM. A server mode and container image make it easy to run in CI, and output can be uploaded to Dependency-Track for continuous analysis.

In the quality loop cdxgen produces the SBOM artefact that release and security gates consume.

The source code is at cdxgen/cdxgen on GitHub under the Apache-2.0 licence, with about 1,100 stars; the most recent commit was on 11 November 2026.

Features

  1. CycloneDX output: Standard SBOM format.
  2. Many ecosystems: Most popular package managers.
  3. Container images: SBOMs for images and OS packages.
  4. Other BOM types: SaaSBOM, CBOM and more.
  5. Server mode: Run as a service.
  6. Dependency-Track upload: Feed continuous analysis.

Pros

  1. Broad coverage: One tool for polyglot projects.
  2. Free to use: Open source under the Apache-2.0 licence, so the core tool costs nothing to use.
  3. Actively maintained: The repository had commits as recent as 11 November 2026.

Cons

  1. Accuracy depends on inputs: Missing lock files reduce precision.
  2. Fast-changing: Frequent releases change behaviour.
  3. Heavy image: Full container image is large.
npm install -g @cyclonedx/cdxgen
cdxgen -r -o bom.json .
cdxgen -t docker -o image-bom.json myapp:1.2.0

Resources:

Pricing

cdxgen is free and open source under the Apache-2.0 licence.

  1. Teams that must ship SBOMs with releases.
  2. Security teams feeding Dependency-Track.

Conclusion

cdxgen is a capable, broad SBOM generator for CycloneDX.

Generate SBOMs from lock files in CI and archive them with each release.

On CheckOps, cdxgen is filed under the Release & CI gates and Security testing stages. Related tools listed here include Cosign, OpenSSF Scorecard, Syft, Grype, OWASP Dependency-Track and Trivy. A short trial on a real project, with your own code, data and pipeline, is usually the fastest way to choose between them, because fit matters more than feature lists. Facts here come from the official site, documentation and repository, checked on 11 November 2026.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with cdxgen side by side.