cdxgen review

Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026

cdxgen is an open-source command-line tool for generating software bills of materials from source code, repositories, package URLs, container images, and binary artifacts. It is aimed at developers, build engineers, and AppSec or compliance teams that need SBOM generation across different software inputs. The project supports Linux, macOS, and Windows, and can also run as a server or be integrated into CI/CD pipelines. Its breadth makes it relevant to teams managing multiple artifact types rather than only application source.

CycloneDX is cdxgen's primary native output, while the tool can also export SPDX 3.0.1 JSON-LD. Container workflows include scanning images and reconstructed root filesystems. The documented feature set extends beyond generation: companion commands can audit, validate, sign, and convert BOMs, as well as generate inventory for other asset types. Dependency-Track is a named integration. These capabilities make cdxgen a fit for teams that want SBOM creation to connect with build pipelines and related inventory workflows; buyers focused on one format or one artifact type may prefer a narrower tool.

The project is open source and has a free plan, with no paid tier structure described here. Deployment options include self-hosted and cloud, and support channels are community resources and documentation. Teams should weigh that support model and command-line orientation against their need for guided onboarding or direct support. cdxgen is a strong candidate for organizations that can operate developer tooling and need source, container, and binary coverage; it is less suited to buyers who prioritize a graphical workflow or a dedicated vendor support channel.

cdxgen pros and cons

• Where it wins
  • Generates CycloneDX BOMs from source, repositories, containers, and binaries
  • Exports SPDX 3.0.1 JSON-LD and supports CI/CD pipelines
  • Companion commands audit, validate, sign, and convert BOMs
• Where it doesn't
  • Command-line workflow may not suit teams seeking a graphical interface
  • Support channels are community and documentation
  • Its primary native output is CycloneDX, with SPDX available as an export

cdxgen fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 14 Nov 2026 · How we research and update