CycloneDX Gradle review
A focused, open-source Gradle plugin for direct and aggregate CycloneDX SBOMs.
Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026
CycloneDX Gradle is an open-source plugin for generating Software Bill of Materials from Gradle dependency graphs. It suits development and release teams that build Gradle projects and need CycloneDX inventories for individual projects or an entire multi-project build. Deployment is self-hosted across Linux, macOS, and Windows, and the plugin integrates directly with Gradle rather than operating as a separate scanning service.
Its free, open-source model keeps adoption straightforward, with community support and no paid tiers to evaluate. The plugin can create a Direct SBOM for each project or an Aggregate SBOM that combines enabled project reports. CycloneDX JSON and XML outputs are enabled by default. Teams can select or exclude Gradle configurations, add component metadata such as names, versions, licenses, and external references, and configure tasks to fail when dependencies remain unresolved. Gradle configuration cache, parallel execution, up-to-date checks, and build cache support help it fit established build workflows.
The scope is deliberately tied to Gradle-resolved dependencies. CycloneDX Gradle does not scan source code, container images, or binaries, so organizations seeking SBOMs from those inputs should choose a tool that supports them. SPDX output is also outside its stated formats. Community support may be insufficient for teams that require a dedicated vendor channel. Choose CycloneDX Gradle when your dependency inventory starts in Gradle and you want direct and aggregate CycloneDX reports; consider an alternative when broader input coverage, additional output standards, or vendor-backed support are priorities.
CycloneDX Gradle pros and cons
- Where it wins
- Produces Direct SBOMs for each Gradle project and Aggregate SBOMs for builds
- Exports CycloneDX in JSON and XML with configuration filtering
- Supports Gradle cache, parallel execution, and unresolved-dependency checks
- Where it doesn't
- Accepts Gradle dependency graphs rather than source, container, or binary inputs
- Does not provide SPDX output; reports are CycloneDX JSON or XML
- Support is community-based rather than a vendor support channel
CycloneDX Gradle fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update