cdxgen
cdxgen: A flexible SBOM command-line tool spanning source, containers, and binaries. Ranked #6 of 33 in SBOM Generation Tools by our editors (7.9/10); pricing: Free plan; best for multi-ecosystem source, container, and binary SBOMs.
At a glance
- Editor score7.9 / 10
- PricingFree plan
- Best forMulti-ecosystem source, container, and binary SBOMs
- Free planYes
- Paid fromFree
- Source code inputYes
- Facts checked14 Nov 2026
Where it wins
- Generates CycloneDX BOMs from source, repositories, containers, and binaries
- Exports SPDX 3.0.1 JSON-LD and supports CI/CD pipelines
- Companion commands audit, validate, sign, and convert BOMs
Where it doesn't
- Command-line workflow may not suit teams seeking a graphical interface
- Support channels are community and documentation
- Its primary native output is CycloneDX, with SPDX available as an export
Our verdict on cdxgen
cdxgen is an open-source command-line tool for generating software bills of materials from source code, repositories, package URLs, container images, and binary artifacts. It is aimed at developers, build engineers, and AppSec or compliance teams that need SBOM generation across different software inputs. The project supports Linux, macOS, and Windows, and can also run as a server or be integrated into CI/CD pipelines. Its breadth makes it relevant to teams managing multiple artifact types rather than only application source.
CycloneDX is cdxgen's primary native output, while the tool can also export SPDX 3.0.1 JSON-LD. Container workflows include scanning images and reconstructed root filesystems. The documented feature set extends beyond generation: companion commands can audit, validate, sign, and convert BOMs, as well as generate inventory for other asset types. Dependency-Track is a named integration. These capabilities make cdxgen a fit for teams that want SBOM creation to connect with build pipelines and related inventory workflows; buyers focused on one format or one artifact type may prefer a narrower tool.
The project is open source and has a free plan, with no paid tier structure described here. Deployment options include self-hosted and cloud, and support channels are community resources and documentation. Teams should weigh that support model and command-line orientation against their need for guided onboarding or direct support. cdxgen is a strong candidate for organizations that can operate developer tooling and need source, container, and binary coverage; it is less suited to buyers who prioritize a graphical workflow or a dedicated vendor support channel.
Your product? Our editors can test cdxgen in depth and publish a review, labelled as paid · from $149/mo →
cdxgen pricing
cdxgen fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| SPDX output | Yes |
| CycloneDX output | Yes |
| Source code input | Yes |
| Container image input | Yes |
| Binary input | Yes |
| Build-pipeline support | Yes |
| Deployment | Self-hosted, Cloud |
| Platforms | Linux, macOS, Windows |
| Support | Community, Docs |
| Built for | Solo, Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 1 integrations: Dependency-Track |
| Pricing | Free plan |
| Website | github.com |
| Facts checked | 14 Nov 2026 |
cdxgen integrations
cdxgen lists 1 integrations on its own site.
- Dependency-Track
Alternatives to cdxgen
- Docker ScoutGenerates and displays SBOMs alongside vulnerability analysis for container images.8.7
- Amazon InspectorA managed AWS security service that pairs continuous scanning with SBOM exports.8.6
- TrivyA free, self-hosted SBOM generator that also scans code, containers, Kubernetes, and AWS.8.5
cdxgen vs the competition
- cdxgen vs Docker Scout
- cdxgen vs Amazon Inspector
- cdxgen vs Trivy
- cdxgen vs Keysight SBOM Generator
- cdxgen vs Syft
- cdxgen vs SBOM Observer CLI
Compare cdxgen with any tool side by side →
Used cdxgen? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used cdxgen for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
cdxgen is listed in our SBOM Generation Tools directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/cdxgen/"><img src="https://www.itechguides.com/best/badge/cdxgen.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update