CycloneDX Python

Free#21 of 33 in SBOM Generation Tools

CycloneDX Python: A focused command-line SBOM generator for Python dependency inputs and environments. Ranked #21 of 33 in SBOM Generation Tools by our editors (6.5/10); pricing: Free plan; best for python teams documenting dependencies in CycloneDX.

6.5/10Editor score

Try CycloneDX Python

CycloneDX Python6.5 Try CycloneDX Python

At a glance

Editor score
6.5 / 10
Pricing
Free plan
Best for
Python teams documenting dependencies in CycloneDX
Free plan
Yes
Paid from
Free
Source code input
No
Facts checked
14 Nov 2026

Where it wins
- Builds SBOMs from Python environments, Pip, Pipenv, and Poetry inputs
- Outputs JSON or XML and lets teams select a CycloneDX version
- Can include dependency relationships and license information
Where it doesn't
- Limited to Python inputs rather than source-code, container, or binary scanning
- Produces CycloneDX only; SPDX output is not supported
- Build-pipeline support is not established

Our verdict on CycloneDX Python

CycloneDX Python is an open-source command-line tool for generating CycloneDX software bills of materials from Python projects and environments. It is aimed at developers and teams that need to document dependencies in Python virtual environments, Pip requirements files, Pipenv manifests or lockfiles, and Poetry projects or lockfiles. It runs on Linux, macOS, and Windows, and is self-hosted rather than a hosted service. Its Python-specific scope makes it a fit when the inputs are Python dependency records, not when a team needs a general scanner for source code, container images, or binaries.

The main value is its coverage of common Python dependency formats alongside environment-based generation. Generated BOMs can include package metadata, dependency relationships, and license information; output is available in JSON or XML, with a selectable CycloneDX specification version. A validation feature can help check generated BOMs. The format boundary matters: CycloneDX is the supported output, while SPDX is not. Teams with a requirement to produce SPDX, or to derive inventory from non-Python inputs, should consider a tool that covers those needs instead.

CycloneDX Python is free and open source, with community support and documentation. It is distributed through Python package managers, so it fits teams comfortable adding a command-line utility to their Python workflow. The product details do not establish build-pipeline support, so teams evaluating automated pipeline integration should confirm that separately before making it a requirement. Choose it for a focused Python-to-CycloneDX workflow; avoid it if you need broader scanning coverage or a different SBOM format.

Your product? Our editors can test CycloneDX Python in depth and publish a review, labelled as paid · from $149/mo →

CycloneDX Python pricing

Plans Free planFree Free to use — no paid tier required for the core job.

See plans on github.com

CycloneDX Python fact sheet

Free plan	Yes
Paid from	Free
SPDX output	No
CycloneDX output	Yes
Source code input	No
Container image input	No
Binary input	No
Build-pipeline support	Not verified
Deployment	Self-hosted
Platforms	Linux, macOS, Windows
Support	Community, Docs
Built for	Solo, Small business, Mid-market, Enterprise (editorial estimate)
Integrations	4 integrations: Pip, Pipenv, Poetry, Python virtual environments
Pricing	Free plan
Website	github.com
Facts checked	14 Nov 2026

CycloneDX Python integrations

CycloneDX Python lists 4 integrations on its own site.

Pip
Pipenv
Poetry
Python virtual environments

Alternatives to CycloneDX Python

See all CycloneDX Python alternatives →

Used CycloneDX Python? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used CycloneDX Python for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Title

Your review

0 characters · at least 80, up to 3,000

Pros (optional · one per line)

Cons (optional · one per line)

Your name (shown with your review)

Role (optional)

Company (optional)

How long have you used it?

I've used CycloneDX Python myself and this is my honest opinion — nobody paid or asked me to write it.

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

CycloneDX Python is listed in our SBOM Generation Tools directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/cyclonedx-python/"><img src="https://www.itechguides.com/best/badge/cyclonedx-python.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 14 Nov 2026 · How we research and update