CycloneDX PHP Composer

At a glance

• Editor score
  6.1 / 10
• Pricing
  Free plan
• Best for
  PHP Composer projects needing CycloneDX SBOMs
• Free plan
  Yes
• Paid from
  Free
• Source code input
  No
• Facts checked
  14 Nov 2026

• Where it wins

  • Generates JSON or XML SBOMs from installed packages or a lock file
  • Supports CycloneDX versions 1.1 through 1.7 and formal validation
  • Can omit development and plugin dependencies and produce reproducible output

• Where it doesn't

  • Limited to PHP Composer projects rather than general source or artifact scanning
  • Outputs CycloneDX only, with no SPDX format
  • Requires PHP 8.1 or later and Composer 2.3 or later

Our verdict on CycloneDX PHP Composer

CycloneDX PHP Composer is an open-source Composer plugin for generating Software Bill of Materials documents from PHP Composer projects. It suits teams that need CycloneDX output tied to Composer-managed dependencies, from solo developers to enterprise teams. The plugin collects package evidence using Composer, preferring an installed project setup while also accepting a lock file. It is a focused dependency inventory tool, not a general-purpose scanner for source code, containers, or binaries.

Its feature set centers on producing a usable CycloneDX document: output can be JSON or XML, and the specification version can be selected from 1.1 through 1.7. Users can omit development and plugin dependencies, request reproducible output, and formally validate the resulting BOM. These controls make it relevant when teams need to standardize dependency inventories or distinguish runtime packages from development tooling. It produces CycloneDX rather than SPDX, so organizations whose workflows require SPDX output should choose a different tool.

The plugin runs on Linux, macOS, and Windows and can be installed globally or as a project development dependency. Its published requirements are PHP 8.1 or later and Composer 2.3 or later, which makes the existing Composer setup central to adoption. Open-source availability and community and documentation support suit teams comfortable integrating a command-line Composer plugin into their own process. Choose it for CycloneDX generation and validation within PHP Composer projects; look elsewhere if you need source-code, container-image, or binary input, or a broader SBOM workflow beyond Composer.

Your product? Our editors can test CycloneDX PHP Composer in depth and publish a review, labelled as paid · from $149/mo →

CycloneDX PHP Composer pricing

CycloneDX PHP Composer fact sheet

CycloneDX PHP Composer integrations

CycloneDX PHP Composer lists 1 integrations on its own site.

• PHP Composer

Alternatives to CycloneDX PHP Composer

• Docker ScoutGenerates and displays SBOMs alongside vulnerability analysis for container images.8.7
• Amazon InspectorA managed AWS security service that pairs continuous scanning with SBOM exports.8.6
• TrivyA free, self-hosted SBOM generator that also scans code, containers, Kubernetes, and AWS.8.5

See all CycloneDX PHP Composer alternatives →

Featured on iTechGuides

CycloneDX PHP Composer is listed in our SBOM Generation Tools directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/cyclonedx-php-composer/"><img src="https://www.itechguides.com/best/badge/cyclonedx-php-composer.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 14 Nov 2026 · How we research and update