CycloneDX PHP Composer review
A focused Composer plugin for creating and validating CycloneDX SBOMs in JSON or XML.
Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026
CycloneDX PHP Composer is an open-source Composer plugin for generating Software Bill of Materials documents from PHP Composer projects. It suits teams that need CycloneDX output tied to Composer-managed dependencies, from solo developers to enterprise teams. The plugin collects package evidence using Composer, preferring an installed project setup while also accepting a lock file. It is a focused dependency inventory tool, not a general-purpose scanner for source code, containers, or binaries.
Its feature set centers on producing a usable CycloneDX document: output can be JSON or XML, and the specification version can be selected from 1.1 through 1.7. Users can omit development and plugin dependencies, request reproducible output, and formally validate the resulting BOM. These controls make it relevant when teams need to standardize dependency inventories or distinguish runtime packages from development tooling. It produces CycloneDX rather than SPDX, so organizations whose workflows require SPDX output should choose a different tool.
The plugin runs on Linux, macOS, and Windows and can be installed globally or as a project development dependency. Its published requirements are PHP 8.1 or later and Composer 2.3 or later, which makes the existing Composer setup central to adoption. Open-source availability and community and documentation support suit teams comfortable integrating a command-line Composer plugin into their own process. Choose it for CycloneDX generation and validation within PHP Composer projects; look elsewhere if you need source-code, container-image, or binary input, or a broader SBOM workflow beyond Composer.
CycloneDX PHP Composer pros and cons
- Where it wins
- Generates JSON or XML SBOMs from installed packages or a lock file
- Supports CycloneDX versions 1.1 through 1.7 and formal validation
- Can omit development and plugin dependencies and produce reproducible output
- Where it doesn't
- Limited to PHP Composer projects rather than general source or artifact scanning
- Outputs CycloneDX only, with no SPDX format
- Requires PHP 8.1 or later and Composer 2.3 or later
CycloneDX PHP Composer fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update