CycloneDX Go

Free#20 of 33 in SBOM Generation Tools

CycloneDX Go: A free, open-source Go tool for CycloneDX SBOMs, with a scope limited to Go projects. Ranked #20 of 33 in SBOM Generation Tools by our editors (6.6/10); pricing: Free plan; best for go teams generating CycloneDX SBOMs.

6.6/10Editor score

Visit CycloneDX Go

CycloneDX Go6.6 Visit CycloneDX Go

At a glance

Editor score
6.6 / 10
Pricing
Free plan
Best for
Go teams generating CycloneDX SBOMs
Free plan
Yes
Paid from
Free
Source code input
Yes
Facts checked
14 Nov 2026

Where it wins
- Generates CycloneDX SBOMs for Go applications, modules, and binaries
- Detects module licenses and can include packages, files, and test dependencies
- Fits Go workflows through GitHub Actions, GoReleaser, and library use
Where it doesn't
- Limited to Go projects rather than broader language coverage
- Outputs CycloneDX, not SPDX
- Community and documentation support may not suit teams needing dedicated support

Our verdict on CycloneDX Go

CycloneDX Go is a free, open-source command-line tool for producing CycloneDX Software Bill of Materials from Go projects. It is aimed at developers and teams that need SBOMs for Go applications, modules, or Go-built binaries. The app command reports modules used by an application, mod summarizes module dependencies, and bin creates a rudimentary SBOM from a binary. It can emit JSON or XML, include package and file components, detect licenses in Go modules, and account for build constraints or test dependencies. Go teams looking specifically for CycloneDX output are the clearest fit; teams needing coverage beyond Go or SPDX output should look elsewhere.

The tool's scope is focused rather than language-agnostic: its inputs are Go source projects, modules, and binaries, with application SBOM configuration based on Go build constraints. It does not take container images as SBOM input, though its documentation describes Docker-based workflows. That distinction matters for teams assessing container artifacts directly. As a CLI, it can be installed from prebuilt binaries or source, and it can also be used as a Go library. Those options support different points in a Go development workflow without making it a hosted SBOM service.

Workflow integration is a notable strength for teams already using Go build tooling: published documentation covers GitHub Actions, GoReleaser, and Docker workflows. The project is free and Apache-2.0 licensed, with documentation and community support channels. Those characteristics make it accessible for solo developers through enterprise teams, but the focused Go coverage and community-oriented support may be limiting for organizations seeking broad portfolio scanning or dedicated vendor support. Choose CycloneDX Go when a Go-specific CycloneDX generator fits your build pipeline; choose a broader tool when you need other ecosystems or container-image input.

Your product? Our editors can test CycloneDX Go in depth and publish a review, labelled as paid · from $149/mo →

CycloneDX Go pricing

Plans Free planFree Free to use — no paid tier required for the core job.

See plans on github.com

CycloneDX Go fact sheet

Free plan	Yes
Paid from	Free
SPDX output	No
CycloneDX output	Yes
Source code input	Yes
Container image input	No
Binary input	Yes
Build-pipeline support	Yes
Deployment	Self-hosted
Platforms	Linux, macOS, Windows
Support	Docs, Community
Built for	Solo, Small business, Mid-market, Enterprise (editorial estimate)
Integrations	3 integrations: GitHub Actions, GoReleaser, Docker
Pricing	Free plan
Website	github.com
Facts checked	14 Nov 2026

CycloneDX Go integrations

CycloneDX Go lists 3 integrations on its own site.

GitHub Actions
GoReleaser
Docker

Alternatives to CycloneDX Go

See all CycloneDX Go alternatives →

Used CycloneDX Go? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used CycloneDX Go for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Title

Your review

0 characters · at least 80, up to 3,000

Pros (optional · one per line)

Cons (optional · one per line)

Your name (shown with your review)

Role (optional)

Company (optional)

How long have you used it?

I've used CycloneDX Go myself and this is my honest opinion — nobody paid or asked me to write it.

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

CycloneDX Go is listed in our SBOM Generation Tools directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/cyclonedx-go/"><img src="https://www.itechguides.com/best/badge/cyclonedx-go.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 14 Nov 2026 · How we research and update