The Best SBOM Generation Tools in 2026
We researched SBOM generation tools using information on their official websites, including pricing pages, plan tables, and product documentation. Rankings focus on the core job of generating standardized bills of materials, value for money, and verified features such as supported formats and input types. The category covers tools for source code, binaries, containers, and build artifacts.
Our top picks
-
Top ranked
Docker Scout#1 of 338.7/10Generates and displays SBOMs alongside vulnerability analysis for container images.
Free plan
-
Runner-up
Amazon Inspector#2 of 338.6/10A managed AWS security service that pairs continuous scanning with SBOM exports.
15-day trial
-
Top-ranked free plan
Trivy#3 of 338.5/10A free, self-hosted SBOM generator that also scans code, containers, Kubernetes, and AWS.
Free plan
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
The full ranking 33 tools, best first
-
Best forTeams generating SBOMs for container images
Generates and displays SBOMs alongside vulnerability analysis for container images.
8.7/10★★★★☆Visit Docker Scout -
Best forAWS teams needing managed SBOM exports
A managed AWS security service that pairs continuous scanning with SBOM exports.
8.6/10★★★★☆Try Amazon Inspector -
Best forFree SBOM generation plus security scanning
A free, self-hosted SBOM generator that also scans code, containers, Kubernetes, and AWS.
8.5/10★★★★☆Visit Trivy -
Best forSBOMs from compiled binaries and firmware
A binary-focused SBOM tool for teams tracking components in shipped software.
- Container image input
- Binary input
- SPDX output
8.4/10★★★★☆Visit Keysight -
Best forBroad SBOM generation across images and filesystems
A free, open-source CLI and Go library for creating and converting CycloneDX and SPDX SBOMs.
- Container image input
- Binary input
- SPDX output
7.9/10★★★★☆Visit Syft -
Best forMulti-ecosystem source, container, and binary SBOMs
A flexible SBOM command-line tool spanning source, containers, and binaries.
- Container image input
- Binary input
- SPDX output
7.9/10★★★★☆Visit cdxgen -
Best forTeams covering code, images, binaries, and Kubernetes
A broad-scope SBOM CLI with useful analysis features and scanner setup requirements.
- Container image input
- Binary input
- Build-pipeline support
7.9/10★★★★☆Visit SBOM Observer -
Best forTeams needing SBOMs across varied software inputs
A free, local-first tool for generating SBOMs and reviewing supplier risk.
- Container image input
- Binary input
- SPDX output
7.8/10★★★★☆Explore BomLens -
Best forOpen-source dependency SBOMs across many ecosystems
A broad, self-hosted toolkit for dependency SBOMs, scanning, and policy checks.
7.7/10★★★★☆Visit site -
Best forFree SPDX SBOMs in build pipelines
A free command-line tool for SPDX SBOMs in build and release workflows.
- Container image input
- Binary input
- SPDX output
7.6/10★★★★☆Visit Microsoft -
Best forSPDX SBOMs for files, archives, and container images
An open-source CLI for generating and working with SPDX SBOMs across varied inputs.
- Container image input
- Binary input
- SPDX output
7.5/10★★★★☆Visit Kubernetes BOM -
Best forFree multi-language SBOMs from manifests and lockfiles
A free, self-hosted tool for generating CycloneDX SBOMs from supported dependency files.
- Source code input
- CycloneDX output
7.4/10★★★★☆Visit Datadog -
Best forRepositories already using GitHub Dependency Graph
A convenient SPDX export for GitHub repositories, limited to the graph’s current state.
- SPDX output
- Build-pipeline support
7.3/10★★★★☆Visit GitHub -
Best forTeams pairing SBOMs with dependency risk management
Pairs SBOM and VEX workflows with reachability analysis and remediation.
7.2/10★★★★☆Visit Endor Labs -
Best forTeams managing SBOMs, licenses, and vulnerabilities
FOSSA pairs SBOM workflows with software composition analysis and policy enforcement.
7.1/10★★★★☆Visit FOSSA -
Best forEnterprises pairing SBOMs with application security
SBOM generation within a broader application and AI security suite.
7.0/10★★★★☆Visit Mend.io -
Best forTeams focused on dependency security and SBOMs
A dependency-security tool that also generates SBOMs through its CLI and API.
6.9/10★★★☆☆Visit Snyk -
Best forTeams seeking static code analysis, not SBOM generation
A strong code-analysis tool, but its listed capabilities do not establish SBOM generation.
6.8/10★★★☆☆Contact Black Duck -
Best forDevelopers validating and transforming CycloneDX BOMs
A local command-line toolkit for building and checking CycloneDX BOM workflows.
- SPDX output
- Build-pipeline support
- Source code input
6.7/10★★★☆☆Visit CycloneDX -
Best forGo teams generating CycloneDX SBOMs
A free, open-source Go tool for CycloneDX SBOMs, with a scope limited to Go projects.
- Binary input
- Build-pipeline support
- Source code input
6.6/10★★★☆☆Visit CycloneDX Go -
Best forPython teams documenting dependencies in CycloneDX
A focused command-line SBOM generator for Python dependency inputs and environments.
- CycloneDX output
6.5/10★★★☆☆Try CycloneDX Python -
Best forGradle builds needing direct and aggregate SBOMs
A focused, open-source Gradle plugin for direct and aggregate CycloneDX SBOMs.
- Build-pipeline support
- CycloneDX output
6.4/10★★★☆☆Try CycloneDX Gradle -
Best forMaven projects needing dependency SBOMs
A focused, open-source option for dependency SBOMs in Maven builds.
- Build-pipeline support
- Source code input
- CycloneDX output
6.3/10★★★☆☆Visit CycloneDX -
Best fornpm projects needing reproducible CycloneDX output
A focused npm CLI for reproducible CycloneDX SBOMs in JSON or XML.
- Build-pipeline support
- Source code input
- CycloneDX output
6.2/10★★★☆☆Visit CycloneDX -
Best forPHP Composer projects needing CycloneDX SBOMs
A focused Composer plugin for creating and validating CycloneDX SBOMs in JSON or XML.
- CycloneDX output
6.1/10★★★☆☆Visit CycloneDX -
Best forRust Cargo projects needing CycloneDX output
A focused, open-source Cargo plugin for CycloneDX SBOM generation.
- Source code input
- CycloneDX output
6.0/10★★★☆☆Visit site -
Best forLicense compliance teams producing SBOM reports
A license-review system that can generate SBOM reports, with compliance at its center.
5.9/10★★★☆☆Visit FOSSology -
Best forGitHub Actions users needing signed SBOM attestations
A GitHub Actions sub-action for generating and attesting SBOMs with Syft or cdxgen.
- Container image input
- Binary input
- SPDX output
5.8/10★★★☆☆Visit Harness -
Best forSmall teams visualizing existing SBOM relationships
Generates SBOMs in three formats and visualizes component relationships as a downloadable PNG.
- SPDX output
- CycloneDX output
5.6/10★★★☆☆Visit SwiftBOM -
Best forAudio noise suppression, not SBOM generation
A capable open-source audio enhancer, but not a tool for generating software bills of materials.
5.5/10★★★☆☆Visit DeepFilterNet -
Best forSource-code security analysis, not SBOM generation
A source-code security analysis tool, not an SBOM generation tool.
5.4/10★★★☆☆Visit GitHub -
Best forTeams building customized embedded Linux distributions
A build system for customized Linux images, not a standalone SBOM generator.
5.3/10★★★☆☆Visit Yocto Project -
Best forEmbedded developers building Zephyr applications
Useful for Zephyr firmware builds and debugging, but not for generating SBOMs.
5.2/10★★★☆☆Visit Zephyr SDK
No tools match those filters.
Compare at a glance
| # | Tool | Free plan | Paid from | SPDX output | CycloneDX output | Source code input | Container image input | Score |
|---|---|---|---|---|---|---|---|---|
| 1 | Docker Scout | Yes | 8.7 | |||||
| 2 | Amazon Inspector | No | 8.6 | |||||
| 3 | Trivy | Yes | Free | 8.5 | ||||
| 4 | Keysight SBOM Generator | Yes | Yes | No | Yes | 8.4 | ||
| 5 | Syft | Yes | Free | Yes | Yes | Yes | Yes | 7.9 |
| 6 | cdxgen | Yes | Free | Yes | Yes | Yes | Yes | 7.9 |
| 7 | SBOM Observer CLI | Yes | Free | No | Yes | Yes | Yes | 7.9 |
| 8 | BomLens | Yes | Free | Yes | Yes | Yes | Yes | 7.8 |
| 9 | OSS Review Toolkit | Free | 7.7 | |||||
| 10 | Microsoft SBOM Tool | Yes | Free | Yes | No | Yes | Yes | 7.6 |
| 11 | Kubernetes BOM (bom) | Yes | Free | Yes | No | Yes | Yes | 7.5 |
| 12 | Datadog SBOM Generator | Yes | Free | No | Yes | Yes | No | 7.4 |
| 13 | GitHub Dependency Graph SBOM Export | Yes | $4/user/mo | Yes | No | No | No | 7.3 |
| 14 | Endor Labs | Yes | 7.2 | |||||
| 15 | FOSSA | Yes | $20/site/mo | 7.1 | ||||
| 16 | Mend.io | $250/user/yr | 7.0 | |||||
| 17 | Snyk Open Source | Yes | $25/user/mo | 6.9 | ||||
| 18 | Black Duck Coverity | 6.8 | ||||||
| 19 | CycloneDX CLI | Free | Yes | Yes | Yes | 6.7 | ||
| 20 | CycloneDX Go | Yes | Free | No | Yes | Yes | No | 6.6 |
| 21 | CycloneDX Python | Yes | Free | No | Yes | No | No | 6.5 |
| 22 | CycloneDX Gradle | Yes | Free | No | Yes | No | No | 6.4 |
| 23 | CycloneDX Maven | Yes | Free | No | Yes | Yes | No | 6.3 |
| 24 | CycloneDX Node.js | Yes | Free | No | Yes | Yes | No | 6.2 |
| 25 | CycloneDX PHP Composer | Yes | Free | No | Yes | No | No | 6.1 |
| 26 | CycloneDX Rust Cargo | Yes | Free | No | Yes | Yes | No | 6.0 |
| 27 | FOSSology | Yes | Free | 5.9 | ||||
| 28 | GitHub SBOM Action | Yes | Yes | Yes | Yes | 5.8 | ||
| 29 | SwiftBOM | Yes | Free | Yes | Yes | 5.6 | ||
| 30 | DeepFilterNet | Yes | Free | 5.5 | ||||
| 31 | GitHub CodeQL | Yes | $30/user/mo | 5.4 | ||||
| 32 | Yocto Project | Yes | Free | 5.3 | ||||
| 33 | Zephyr SDK | Yes | Free | 5.2 |
Head-to-head All 28 comparisons →
- Docker Scout vs Amazon Inspector
- Docker Scout vs Trivy
- Docker Scout vs Keysight SBOM Generator
- Docker Scout vs Syft
- Docker Scout vs cdxgen
- Docker Scout vs SBOM Observer CLI
- Docker Scout vs BomLens
- Amazon Inspector vs Trivy
- Amazon Inspector vs Keysight SBOM Generator
Explore other topics All topics →
- AI Tools 304 directories · 8,306 tools ranked AI Writing Tools · AI Video Generators · Text-to-Speech Software
- Web Hosting & Domains 275 directories · 6,107 tools ranked Shared Web Hosting · Managed Cloud Hosting · Dedicated Server Hosting
- Productivity 157 directories · 4,948 tools ranked Note-Taking Apps · Calendar Apps · Project Management Software
- Marketing 139 directories · 4,058 tools ranked SEO Tools · Influencer Marketing Platforms · Email Marketing Software
- Sales & CRM 152 directories · 4,161 tools ranked Real Estate CRM Software · CRM Software · Proposal Software
- Customer Service 55 directories · 1,547 tools ranked Chatbot Builders · Knowledge Base Software · Call Center Software
How we rank SBOM generation tools
Every tool on this page was researched by iTechGuides Editors from its official website — pricing pages, plan tables and product documentation. We rank on how well each one does this category's core job, what the free or entry plan includes, and where it falls short. Where we have enough verified facts, the score out of 10 is a rubric — job fit, value and how much we could verify — shown with its breakdown on every tool's page; a tool we have not verified enough to score yet shows its rank without a number. Scores are re-checked when a product changes its plans. Read the full editorial policy, or submit a tool we missed.
Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026
Last updated · How we research and update