How to generate an SBOM

You do not have an SBOM yet? These are the standard, free tools that produce one from what you already have: a container image, a source directory, a compiled binary, or a package manifest. Each writes a CycloneDX or SPDX file, and SBOM Total reads both. Pick the one that matches your artifact, run one command, then scan the result here.

Open the checker See what we analyze

Which format?Either works. CycloneDX and SPDX are the two commonly used, machine-readable formats, and both satisfy the CRA's SBOM requirement. If you have no preference, CycloneDX JSON is a safe default. Whatever you produce, drop it on the checker.

What you have	Reach for
A container image	Syft, Trivy or Docker Scout
A source directory / repo	Syft, Trivy or cdxgen
A compiled binary or firmware	Syft
A Node.js or Python project	cdxgen or the language-native tool
A Yocto or Zephyr build	the build system itself (see below)

Syft

Best for: images, directories and binaries, one tool for almost everything

Anchore's Syft is the most versatile generator: point it at an image, a folder or a binary and it writes CycloneDX or SPDX. The -o format=file syntax picks the format and the output path in one go.

# Install (macOS/Linux)
curl -sSfL https://get.anchore.io/syft | sudo sh -s -- -b /usr/local/bin

# From a container image, a directory or a binary
syft nginx:latest    -o cyclonedx-json=sbom.cdx.json
syft ./my-project    -o spdx-json=sbom.spdx.json
syft ./firmware.bin  -o cyclonedx-json=sbom.cdx.json

Trivy

Best for: images and directories, if you already use it for scanning

Aqua's Trivy generates an SBOM as well as scanning. By default --format cyclonedx emits the inventory without vulnerabilities, which is exactly what you want to hand to SBOM Total, where the full engine panel does the analysis.

# Install: https://trivy.dev  (brew install trivy, apt, ...)

# From a directory
trivy fs    --format cyclonedx --output sbom.cdx.json .

# From a container image
trivy image --format cyclonedx --output sbom.cdx.json alpine:3.20

# SPDX instead of CycloneDX
trivy fs    --format spdx-json --output sbom.spdx.json .

cdxgen

Best for: polyglot source projects and CI, deep dependency detection

OWASP's cdxgen auto-detects the ecosystems in a repository (npm, Python, Java, Go, Rust and many more) and produces a single CycloneDX document. It is a good fit when a project mixes languages.

# Install (renamed from @cyclonedx/cdxgen in v13)
npm install -g @cdxgen/cdxgen

# Auto-detect the ecosystem in the current directory
cdxgen -o sbom.json .

# Force a language when auto-detection needs a hint
cdxgen -t python -o sbom.json .

Docker Scout

Best for: container images, no extra install if you have Docker

If Docker is already on the machine, docker scout sbom produces an SBOM for any local or remote image with nothing else to install. Redirect the output to a file and scan it.

# Docker Scout ships with recent Docker Desktop / Docker Engine

# CycloneDX for a local or remote image
docker scout sbom --format cyclonedx nginx:latest > sbom.cdx.json

# SPDX instead
docker scout sbom --format spdx nginx:latest > sbom.spdx.json

Language-native tools

Best for: a single-language project, when you want the manifest to drive it

Each ecosystem has an official CycloneDX generator that reads the lockfile or environment directly. Two common ones:

Node.js

# Node.js project (run in the folder with package.json)
npx @cyclonedx/cyclonedx-npm --output-file sbom.json

Python

# Python
python -m pip install cyclonedx-bom

# From the active virtual environment
cyclonedx-py environment -o sbom.json

# ...or from a requirements file
cyclonedx-py requirements -o sbom.json

CycloneDX publishes equivalents for many more ecosystems (Go, Rust, PHP, .NET, Gradle, Maven). See the CycloneDX Tool Center if yours is not listed here.

Embedded builds

For firmware, do not scan a binary if the build system can emit the real bill of materials: it knows every recipe, version and license that went into the image. Yocto emits SPDX with create-spdx, and Zephyr emits SPDX with west spdx. Both have their own step-by-step guide:

SBOM from Yocto SBOM from Zephyr

A note on quality. The more each component carries a version, a supplier, a PURL or CPE, a license and a hash, the better the scan: CVE matching is more accurate and the SBOM meets the NTIA and CISA 2026 minimum elements. Prefer a generator that reads a lockfile or the build over one that guesses from a stripped binary, and generate the SBOM as part of the build so it stays reproducible.

NextScan your new SBOM ThenLearn to read every result