CycloneDX Maven
CycloneDX Maven: A focused, open-source option for dependency SBOMs in Maven builds. Ranked #23 of 33 in SBOM Generation Tools by our editors (6.3/10); pricing: Free plan; best for maven projects needing dependency SBOMs.
At a glance
- Editor score6.3 / 10
- PricingFree plan
- Best forMaven projects needing dependency SBOMs
- Free planYes
- Paid fromFree
- Source code inputYes
- Facts checked14 Nov 2026
Where it wins
- Includes direct and transitive dependencies in aggregate BOMs
- Outputs CycloneDX SBOMs in JSON or XML
- Supports multi-module builds and Maven lifecycle configuration
Where it doesn't
- Focused on Apache Maven projects
- Does not output SPDX
- Does not accept container images or standalone binaries as input
Our verdict on CycloneDX Maven
For Java teams working in Apache Maven, CycloneDX Maven generates CycloneDX Software Bills of Materials from project dependencies. It is an open-source plugin maintained by the CycloneDX project under the OWASP Foundation, rather than a hosted subscription service. Its scope is specific: Maven projects and their dependencies, not container images or standalone binaries. That focus makes it a natural fit when dependency inventory is the goal and Maven is already the build environment; teams seeking a broader input scope should consider another tool.
The plugin can produce aggregate BOMs covering direct and transitive dependencies, with an aggregate goal for multi-module Maven reactor projects. Teams can exclude selected reactor modules from an aggregate BOM, and configure the plugin as part of the Maven build lifecycle. Output is available in CycloneDX JSON or XML, and vulnerability disclosure information can be attached. These options make it suited to generating dependency inventories within an existing Maven build, rather than requiring a separate hosted workflow.
CycloneDX Maven is open source and has a free plan, with self-hosted deployment. Its integration is Apache Maven; the published scope is CycloneDX output rather than SPDX, and the plugin is not described as accepting container or binary inputs. Choose it for Maven dependency SBOMs, including multi-module builds, when that format and input scope are sufficient. It is a less suitable match if you need a hosted product, broader artifact inputs, or SPDX output.
Your product? Our editors can test CycloneDX Maven in depth and publish a review, labelled as paid · from $149/mo →
CycloneDX Maven pricing
CycloneDX Maven fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| SPDX output | No |
| CycloneDX output | Yes |
| Source code input | Yes |
| Container image input | No |
| Binary input | No |
| Build-pipeline support | Yes |
| Deployment | Self-hosted |
| Built for | Solo, Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 1 integrations: Apache Maven |
| Pricing | Free plan |
| Website | github.com |
| Facts checked | 14 Nov 2026 |
CycloneDX Maven integrations
CycloneDX Maven lists 1 integrations on its own site.
- Apache Maven
Alternatives to CycloneDX Maven
- Docker ScoutGenerates and displays SBOMs alongside vulnerability analysis for container images.8.7
- Amazon InspectorA managed AWS security service that pairs continuous scanning with SBOM exports.8.6
- TrivyA free, self-hosted SBOM generator that also scans code, containers, Kubernetes, and AWS.8.5
See all CycloneDX Maven alternatives →
Used CycloneDX Maven? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used CycloneDX Maven for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
CycloneDX Maven is listed in our SBOM Generation Tools directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/cyclonedx-maven/"><img src="https://www.itechguides.com/best/badge/cyclonedx-maven.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update