CycloneDX Rust Cargo

At a glance

• Editor score
  6.0 / 10
• Pricing
  Free plan
• Best for
  Rust Cargo projects needing CycloneDX output
• Free plan
  Yes
• Paid from
  Free
• Source code input
  Yes
• Facts checked
  14 Nov 2026

• Where it wins

  • Generates JSON or XML CycloneDX SBOMs from Cargo projects
  • Selects crates, binaries, targets, features, and target platforms
  • Records dependency licenses and offers a Rust SBOM library

• Where it doesn't

  • Outputs CycloneDX, not SPDX, for SBOM format coverage
  • Targets Cargo projects, not container-image inputs
  • No standalone binary scanning or AI-assisted features

Our verdict on CycloneDX Rust Cargo

CycloneDX Rust Cargo combines a command-line Cargo plugin with a Rust library for creating and handling CycloneDX software bills of materials. It is designed for developers and teams building Rust projects with Cargo, from solo work through enterprise environments. The plugin uses Cargo metadata and the lockfile to describe project dependencies, and it can represent a crate, separate binaries, or all Cargo targets.

As an open-source project from the OWASP Foundation, CycloneDX Rust Cargo is available under the Apache 2.0 license and uses a self-hosted deployment model. It runs on Windows, macOS, and Linux. Generation options let teams select Cargo features and target platforms, while dependency scope can include every dependency or only top-level entries. The resulting CycloneDX document can be emitted as JSON or XML, and dependency license information is recorded for inventory and review workflows.

Its strongest fit is a Rust Cargo pipeline that needs focused CycloneDX generation rather than a broad scanning suite. The accompanying cyclonedx-bom library also provides Rust code for reading and writing CycloneDX SBOMs, which can support custom tooling around the generated documents. The scope is deliberately narrow: the stated input is Cargo project data, and the plugin does not cover container-image inputs or standalone binary scanning. Teams that require SPDX output, container image analysis, or SBOM generation beyond Rust Cargo should select a tool built for those formats or inputs instead.

Your product? Our editors can test CycloneDX Rust Cargo in depth and publish a review, labelled as paid · from $149/mo →

CycloneDX Rust Cargo pricing

CycloneDX Rust Cargo fact sheet

Alternatives to CycloneDX Rust Cargo

• Docker ScoutGenerates and displays SBOMs alongside vulnerability analysis for container images.8.7
• Amazon InspectorA managed AWS security service that pairs continuous scanning with SBOM exports.8.6
• TrivyA free, self-hosted SBOM generator that also scans code, containers, Kubernetes, and AWS.8.5

See all CycloneDX Rust Cargo alternatives →

Featured on iTechGuides

CycloneDX Rust Cargo is listed in our SBOM Generation Tools directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/cyclonedx-rust-cargo/"><img src="https://www.itechguides.com/best/badge/cyclonedx-rust-cargo.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 14 Nov 2026 · How we research and update