SBOMApp - SBOM Generator & Vulnerability Scanner

Name: SBOMApp - SBOM Generator & Vulnerability Scanner
Author: mcpsbom

作者：mcpsbom版本 1.1.0i★ –i在云端运行

注册名称io.github.mcpsbom/sbom-mcp

安装

概览

作者提供的说明（英文原文）

Generate SBOMs, scan vulnerabilities, and analyze dependencies from local projects or Git repos.

PopNx MCP 的三大支柱

这三项永远不会合并成一个分数：意见、测量和人气是不同的东西。

用户评价i暂无评价评价功能将在后续阶段与账户功能一起开放
我们的基础检查i1 项中通过 1 项依据公开信息检查；尚未扫描代码
使用情况i尚未统计★ –

它能帮你做什么

我们还没有为它写通俗的介绍。下面是我们从注册中心读取到的事实。

连接方式: 在云端运行
传输方式: Streamable HTTP
分类: 开发者工具
你需要填写：Authorization

安装

选择你使用的 AI 应用，然后复制设置。

安装之前

基础检查：1 项中通过 1 项
在作者的服务器上运行：你向它提出的内容会经过他们的服务器。
需要你自己填写： Authorization

标为机密的值是你账户的钥匙。千万不要分享给别人，也不要粘贴到聊天里。

你需要

在云端运行无需安装任何东西，通过互联网连接

你用的是哪个应用？

ClaudeClaude CodeCursorVS CodeChatGPT

在上方选择你的应用。我们会记住它，下次按钮会显示“安装到 …”。

这个地址需要在请求的 header 中放入密钥，而添加连接器的菜单无法设置。请改用 Claude Code、Cursor 或 VS Code。

在终端中运行这条命令

claude mcp add --transport http sbom https://mcp.sbomapp.com/mcp --header 'Authorization: your-value'

运行前请先填写空着的值。

在 Cursor 中打开

或者自己复制设置

粘贴到项目中的 .cursor/mcp.json，或 ~/.cursor/mcp.json

{
  "mcpServers": {
    "sbom": {
      "url": "https://mcp.sbomapp.com/mcp",
      "headers": {
        "Authorization": "your-value"
      }
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

在 VS Code 中打开

或者自己复制设置

粘贴到项目中的 .vscode/mcp.json

{
  "servers": {
    "sbom": {
      "type": "http",
      "url": "https://mcp.sbomapp.com/mcp",
      "headers": {
        "Authorization": "your-value"
      }
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

这个地址需要在请求的 header 中放入密钥，而添加连接器的菜单无法设置。请改用 Claude Code、Cursor 或 VS Code。

你的选择通过 Cookie 保存在这台设备上，无需账户。

需要你填写的值

Authorization 机密必填 HTTP header
Bearer token (API key) for authentication. Get your API key from https://sbomapp.com

这些设置是根据作者在注册中心的条目生成的。如果 README 的写法不同，请以 README 为准。

它能做什么

我们还没有读取这个服务器的工具列表；我们会轮流检查各个端点。

基础检查i

我们检查的是任何人都能看到的信息；我们没有阅读代码。不适用的检查项不计入总数。 · 检查于 2026年11月7日

✓ 通过
作者与仓库一致
注册名称已通过 GitHub 账户 mcpsbom 验证，该账户拥有此仓库
… 尚未检查
仍在维护
我们还没有从 GitHub 读取这个仓库
… 尚未检查
有许可证
我们还没有从 GitHub 读取这个仓库
… 尚未检查
端点有响应
尚未检查；我们会轮流检查各个端点
… 尚未检查
使用 OAuth 登录
尚未检查；我们会轮流检查各个端点
… 尚未检查
工具描述中没有隐藏指令
尚未检查；我们会在检查端点时读取工具列表

与“开发者工具”中的其他服务器比较i

星标数多于此分类中其他 1396 个服务器的 0%
发布到注册中心的时间比此分类中其他 1396 个服务器的 6% 更新
基础检查结果等于或优于此分类中其他 1396 个服务器的 100%

与注册中心里这个分类中所有活跃的服务器比较。只有当发布者拥有该仓库时，星标数才计入。

常见问题

SBOMApp - SBOM Generator & Vulnerability Scanner 安全吗？

它在 1 项适用的基础检查中通过了 1 项。我们没有阅读代码。在添加密钥或令牌之前，请先看看这个服务器要求哪些权限，并使用只具备所需权限的密钥。

它需要哪些密钥或代码？

你需要填写：Authorization

它在我的电脑上运行还是在云端？

它在作者的云端运行。通过互联网连接，无需安装，但你发送的内容会经过作者的服务器。

它还在维护吗？

GitHub 仓库最后更新于–，最新版本（1.1.0）于9个月前进入注册中心。

哪些应用可以使用它？

支持 MCP 的应用，例如 Claude Desktop、Claude Code、Cursor 和 VS Code。它通过 URL 连接，所以接受远程 MCP 服务器的应用也可以使用，例如开启开发者模式的 ChatGPT。

有什么可以替代它？

同一分类中有：GitHub, Desktop Commander, Cloudflare MCP

替代选择

同一分类中其他作者的服务器，按星标数排序。

如何看卡片：★ GitHub 星标i三大支柱：评价 · 检查 · 使用情况i更新 = 最新版本发布到注册中心的时间i

GitHub

作者：github

Connect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.

电脑或云端★ 34,245MIT4天前更新

安装

Desktop Commander

作者：wonderwhy-er

MCP server for terminal commands, file operations, and process management

在你的电脑上运行★ 10,225MIT16天前更新

安装

Cloudflare MCP

作者：cloudflare

Cloudflare MCP servers

在云端运行★ 4,446Apache-2.014个月前更新

安装

作者的 README

打开 README

按原文从作者的仓库复制。PopNx MCP 没有审查或背书其内容。HTML、图片和脚本已被移除。链接会离开本站。

SBOM for VS Code by SBOMApp!

“AI wrote the code – now audit what’s inside”

SBOM MCP Server - SBOMApp MCP Server brings software supplychain security assistant inside VS Code. With a simple natural language prompt, developers can instantly generate SBOMs (SPDX/CycloneDX), scan for CVEs, Verify Licence Compliance, and get actionable remediation guidance.

No switching tools, no manual scripts, everything happens right inside your editor, keeping you fast, secure, and focused.

Why teams choose SBOMApp MCP:

Endtoend visibility: Build complete SBOMs (including transitive deps) from local workspaces or Git repos, then attach them to builds and releases.

Actionable security: Run vulnerability scans, drill into CVE details, and get fix versions and upgrade paths.

License clarity: Identify copyleft and other risky licenses early with auditfriendly summaries.

Copilot + MCP native: Works naturally in Agent Mode, so prompts like “generate sbom”, “scan vulnerabilities”

Frictionless onboarding: Start with a 7day free trial or connect your enterprise server using secure tokens stored by VS Code.

Designed for securityminded engineering orgs: Whether you’re shipping regulated software, hardening your SDLC, or preparing for customer SBOM requests, SBOMApp MCP delivers the SBOM, CVE, and license insights your teams need

Absolute Privacy Guarantee!

We don’t store your code, your SBOMs, your dependencies, or any project data — ever. Only your email (for free trial) and API token are stored securely. Everything else stays completely on your machine.

SBOMApp MCP Server

Connect to a remote SBOM MCP Server to perform software bill of materials analysis, vulnerability scanning, opensource license details and dependency management.

Quick Start Guide

Step 1: Install the Extension

Open VS Code
Go to Extensions (Ctrl+Shift+X or Cmd+Shift+X on Mac)
Search for "SBOMApp MCP Server"
Click Install

Or install directly from the VS Code Marketplace

Step 2: Free Trial - Get Started Instantly!

New users get a FREE 90-day trial with 100 Tokens - no credit card required!

Automatic Trial Registration:

Install the extension
On first launch, you'll be prompted to start your free trial
Enter your email address
Your API key is automatically configured - you're ready to go!

Simple steps to Activate Trial!

prerequisites : Visual Studio Code should be Installed with langauage Models enabled.

Click on the SBOM MCP status bar!

Click on the start free trial option,

Click on th start free trial popup,

Enter your official email-id & click Enter,

After sucessful Registration, you will get the trial activation notification!

Reload the Window using the command "CTRL+SHIFT+P" or click "Command Palette" and Select "Developer:Reload Window" to Refresh the MCP Server!

Trial Features:

Feature	Trial
Validity	90 days
Token Requests	100 tokens
SBOM Generation	yes
Vulnerability Scanning	yes

Upgrade to Pro:

When your trial expires or tokens are exhausted, upgrade at: https://payment.sbomapp.com or https://sbomapp.com

Manual Configuration (Enterprise Users):

If you have a license key from your administrator:

Press Ctrl+Shift+P → "SBOMApp: Configure Remote Server"
Enter your Server URL: https://mcp.sbomapp.com/mcp
Enter your API Key

Step 3: Test the Connection

Press Ctrl+Shift+P again
Type "SBOMApp: Test Connection" and press Enter
You should see a success message with available tools count

Step 4: Restart the VS code.

Mandatory step! Once credentials and connections are tested, Kindly restart the VS Code.

Step 5: Start Using "@sbomapp" in chat box

Once connected (green status bar shows ✓), you can ask GitHub Copilot:

Note: Ensure your project is imported in VS Code before using SBOMApp MCP.

"@sbomapp/help"

"@sbomapp Generate an SBOM for my current project or Generate an SBOM for my current project". "@sbomapp scan vulnerabilities" or "Check if lodash 4.17.0 has any security vulnerabilities"

---

Features

Easy Configuration: Simple setup wizard to connect to your SBOM MCP Server
Secure Authentication: Bearer token authentication with secure storage
Connection Testing: Verify your server connection before use
Status Bar Indicator: See connection status at a glance
Tool Browser: View all available SBOM analysis tools
Direct Tool: Say "@sbomapp Generate SBOM for my current project" in chat - it just works!

Commands

Command	Description
`SBOMApp: Start Free Trial`	Register for a free 7-day trial
`SBOMApp: Check Trial Status`	View remaining tokens and expiry
`SBOMApp: Check Token Usage`	View detailed Token usage statistics
`SBOMApp: Configure Remote Server`	Set up server URL and API key
`SBOMApp: Test Connection`	Verify connection to the server
`SBOMApp: Show Available Tools`	Browse available SBOM analysis tools
`SBOMApp: Disconnect`	Disconnect from the server

Configuration

This extension provides the following settings:

Setting	Description	Default
`sbomRemoteMcp.serverUrl`	URL of the remote SBOM MCP Server	(empty)
`sbomRemoteMcp.apiKey`	API key for authentication	(empty)
`sbomRemoteMcp.autoConnect`	Auto-connect on VS Code startup	`true`
`sbomRemoteMcp.showStatusBar`	Show status in status bar	`true`

Available Tools

Once connected, you can use these SBOM analysis tools with GitHub Copilot:

Tool	Description
`sbomapp_generateSbomFromWorkspace`	Generate SBOM, scan vulnerabilities, analyze dependencies, and check licenses for your current project
`generate_sbom`	Generate a complete SBOM with vulnerability report for your project
`scan_vulnerabilities`	Scan your project for security vulnerabilities with CVE details
`analyze_dependencies`	Analyze all dependencies — types, licenses, and risk assessment

Tip: Just type "generate sbom", "scan vulnerabilities", or "analyze dependencies" in Copilot chat — the extension automatically analyzes your current project!

Example Copilot Prompts after SBOM and vulnerabilities Generation

Try asking Copilot these questions:

"Fix the above Identified vulnerabilities"
"Replace component_1 with suitable secure component"

Requirements

VS Code 1.106 or higher
Access to a running SBOM MCP Server
Valid API key for authentication

Getting an API Key

Option 1: Free Trial (Recommended for Individual Users)

Start the extension and follow the trial registration prompt
Or run command: SBOMApp: Start Free Trial
Trial includes: 90 days, 100 Tokens

Option 2: Purchase Pro License

Visit https://payment.sbomapp.com or https://sbomapp.com to purchase
Get Tokens and advanced features
API key delivered instantly via email

Option 3: Enterprise License

Contact your SBOM MCP Server administrator
Email: sbomappsupport@iarminfo.com

Troubleshooting

Connection Failed

Verify the server URL is correct (should end with /mcp)
Check that the server is running and accessible
Ensure your API key is valid and not expired
Check if firewall allows the connection

Tools Not Working

Make sure the connection is established (green ✓ in status bar)
Check VS Code MCP settings are configured correctly
Try disconnecting and reconnecting
Restart VS Code if issues persist

Status Bar Not Showing

Check that sbomRemoteMcp.showStatusBar is enabled in settings
Try reloading VS Code (Ctrl+Shift+P → "Reload Window")

Check Token Usage Status

Click on the status bar "SBOM MCP" → Select "Check token Usage"
View detailed usage statistics in the output panel

Check Trial Status

Click on the status bar "SBOM MCP" → Select "Check Trial Status"
View remaining tokens, days left, and upgrade options
Status bar shows trial info: ✓ SBOM MCP [Trial: 450]

Trial Expired or Tokens Exhausted

Status bar shows: SBOM MCP [Trial Expired]
Click "Upgrade Now" in the popup to purchase Pro license
Or run command: SBOMApp: Configure Remote Server to enter a new API key
Upgrade at: https://payment.sbomapp.com or https://sbomapp.com

Authentication Errors

Verify your API key is correct
Ensure the API key has proper permissions
Contact your administrator if the key was recently rotated

Privacy & Security

API keys are stored in VS Code's secure storage
All communication uses HTTPS (when configured)
No data is sent to third parties
Credentials are never logged or exported

Support

📧 Email: sbomappsupport@iarminfo.com