Datadog SBOM Generator review
A free, self-hosted tool for generating CycloneDX SBOMs from supported dependency files.
Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026
Datadog SBOM Generator is a free command-line tool and Go library for creating software bills of materials from local repository directories. It is suited to teams that want to inventory declared dependencies across varied development stacks, whether working on Linux, macOS, or Windows. Its self-hosted approach keeps the scan focused on repository files rather than requiring a hosted workflow, and the tool is open source.
The breadth of supported dependency ecosystems is a central strength: package managers span .NET, C++, Go, Java, JavaScript, PHP, Python, Ruby, Rust, and Swift. Scans can cover multiple directories in one run or recurse through directories. Filters can narrow work by parser, package manager, language, or lockfile, while path and package exclusions help tailor the resulting inventory. Optional reachability analysis adds another way to examine dependencies. Output is CycloneDX 1.5, so this fits teams whose SBOM workflows use that format; it is not a fit when SPDX output is required.
Its input boundary matters when choosing a tool. Datadog SBOM Generator reads supported manifests and lockfiles, which makes it useful for source repositories with dependency files but not for container-image or arbitrary-binary scanning. Teams seeking repository-level SBOMs across multiple languages can choose it without a plan purchase. Organizations that need artifact scanning beyond declared dependencies, or require SPDX, should look for a tool that handles those inputs or formats instead.
Datadog SBOM Generator pros and cons
- Where it wins
- Covers package managers across ten language ecosystems
- Scans recursively or across multiple directories in one run
- Offers parser filters, exclusions, and optional reachability analysis
- Where it doesn't
- Generates CycloneDX output, not SPDX
- Does not scan container images or arbitrary binaries
- Input is limited to supported manifests and lockfiles
Datadog SBOM Generator fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update