CycloneDX Gradle

At a glance

• Editor score
  6.4 / 10
• Pricing
  Free plan
• Best for
  Gradle builds needing direct and aggregate SBOMs
• Free plan
  Yes
• Paid from
  Free
• Source code input
  No
• Facts checked
  14 Nov 2026

• Where it wins

  • Produces Direct SBOMs for each Gradle project and Aggregate SBOMs for builds
  • Exports CycloneDX in JSON and XML with configuration filtering
  • Supports Gradle cache, parallel execution, and unresolved-dependency checks

• Where it doesn't

  • Accepts Gradle dependency graphs rather than source, container, or binary inputs
  • Does not provide SPDX output; reports are CycloneDX JSON or XML
  • Support is community-based rather than a vendor support channel

Our verdict on CycloneDX Gradle

CycloneDX Gradle is an open-source plugin for generating Software Bill of Materials from Gradle dependency graphs. It suits development and release teams that build Gradle projects and need CycloneDX inventories for individual projects or an entire multi-project build. Deployment is self-hosted across Linux, macOS, and Windows, and the plugin integrates directly with Gradle rather than operating as a separate scanning service.

Its free, open-source model keeps adoption straightforward, with community support and no paid tiers to evaluate. The plugin can create a Direct SBOM for each project or an Aggregate SBOM that combines enabled project reports. CycloneDX JSON and XML outputs are enabled by default. Teams can select or exclude Gradle configurations, add component metadata such as names, versions, licenses, and external references, and configure tasks to fail when dependencies remain unresolved. Gradle configuration cache, parallel execution, up-to-date checks, and build cache support help it fit established build workflows.

The scope is deliberately tied to Gradle-resolved dependencies. CycloneDX Gradle does not scan source code, container images, or binaries, so organizations seeking SBOMs from those inputs should choose a tool that supports them. SPDX output is also outside its stated formats. Community support may be insufficient for teams that require a dedicated vendor channel. Choose CycloneDX Gradle when your dependency inventory starts in Gradle and you want direct and aggregate CycloneDX reports; consider an alternative when broader input coverage, additional output standards, or vendor-backed support are priorities.

Your product? Our editors can test CycloneDX Gradle in depth and publish a review, labelled as paid · from $149/mo →

CycloneDX Gradle pricing

CycloneDX Gradle fact sheet

CycloneDX Gradle integrations

CycloneDX Gradle lists 1 integrations on its own site.

• Gradle

Alternatives to CycloneDX Gradle

• Docker ScoutGenerates and displays SBOMs alongside vulnerability analysis for container images.8.7
• Amazon InspectorA managed AWS security service that pairs continuous scanning with SBOM exports.8.6
• TrivyA free, self-hosted SBOM generator that also scans code, containers, Kubernetes, and AWS.8.5

See all CycloneDX Gradle alternatives →

Featured on iTechGuides

CycloneDX Gradle is listed in our SBOM Generation Tools directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/cyclonedx-gradle/"><img src="https://www.itechguides.com/best/badge/cyclonedx-gradle.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 14 Nov 2026 · How we research and update