BomLens
BomLens: A free, local-first tool for generating SBOMs and reviewing supplier risk. Ranked #8 of 33 in SBOM Generation Tools by our editors (7.8/10); pricing: Free plan; best for teams needing SBOMs across varied software inputs.
At a glance
- Editor score7.8 / 10
- PricingFree plan
- Best forTeams needing SBOMs across varied software inputs
- Free planYes
- Paid fromFree
- Source code inputYes
- Facts checked14 Nov 2026
Where it wins
- Scans source, containers, binaries, firmware, and existing SBOMs
- Generates CycloneDX 1.6 and can emit SPDX 2.3 copies
- Offers browser, CLI, and desktop interfaces for local workflows
Where it doesn't
- Runs locally with Docker rather than as hosted SaaS
- Desktop installers are available for Windows and macOS only
- Listed support channels are community and documentation
Our verdict on BomLens
BomLens is an open-source supply-chain security tool from SK Telecom for creating software bills of materials and assessing supply-chain risk. It suits teams that need to scan different kinds of inputs, including source folders, GitHub repositories, ZIP archives, container images, binaries, firmware, and existing SBOMs. Its local-first approach makes it relevant to organizations that want to run scans in their own environment rather than use a hosted SaaS service.
The breadth of inputs is a central strength. BomLens generates CycloneDX 1.6 SBOMs and can emit SPDX 2.3 copies with the --spdx option. It can also produce open-source notices and vulnerability and security reports, and assess supplier-provided SBOMs for license and vulnerability risk. A browser-based interface provides live logs and downloadable results; a command-line interface supports CI/CD pipeline integration. These options make it useful both for reviewing individual artifacts and for incorporating SBOM generation into a build process. TRUSCA and Dependency-Track are listed integrations.
BomLens is described as open source under Apache License 2.0, with a free plan. It runs locally using Docker, and desktop installers are available for Windows and macOS. That deployment model favors teams comfortable operating local tooling, but it is not a fit for buyers seeking a hosted SaaS service. Support channels are community and documentation, so organizations that require a different support model should weigh that before adopting it. Choose BomLens when broad input coverage, multiple SBOM formats, and local execution matter; consider an alternative if hosted delivery is a requirement.
Your product? Our editors can test BomLens in depth and publish a review, labelled as paid · from $149/mo →
BomLens pricing
BomLens fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| SPDX output | Yes |
| CycloneDX output | Yes |
| Source code input | Yes |
| Container image input | Yes |
| Binary input | Yes |
| Build-pipeline support | Yes |
| Deployment | Self-hosted, Desktop |
| Platforms | Web, Windows, macOS, Linux |
| Support | Community, Docs |
| Built for | Solo, Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 2 integrations: TRUSCA, Dependency-Track |
| Pricing | Free plan |
| Website | sktelecom.github.io |
| Facts checked | 14 Nov 2026 |
BomLens integrations
BomLens lists 2 integrations on its own site.
- TRUSCA
- Dependency-Track
Alternatives to BomLens
- Docker ScoutGenerates and displays SBOMs alongside vulnerability analysis for container images.8.7
- Amazon InspectorA managed AWS security service that pairs continuous scanning with SBOM exports.8.6
- TrivyA free, self-hosted SBOM generator that also scans code, containers, Kubernetes, and AWS.8.5
See all BomLens alternatives →
BomLens vs the competition
- BomLens vs Docker Scout
- BomLens vs Amazon Inspector
- BomLens vs Trivy
- BomLens vs Keysight SBOM Generator
- BomLens vs Syft
- BomLens vs cdxgen
Compare BomLens with any tool side by side →
Used BomLens? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used BomLens for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
BomLens is listed in our SBOM Generation Tools directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/bomlens/"><img src="https://www.itechguides.com/best/badge/bomlens.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update