AIBase
EN
Explore
MCP Sbom Server
M

MCP Sbom Server

A Python - based MCP server that performs Trivy scans and generates SBOM reports in CycloneDX format.
SecurityDeveloper tools#Security Scanning#SBOM Generation#MCP Service#Trivy Integration.Python
2.5 points
10.6K
Open Site

Overview

Installation

Content Details

Alternatives

What is the MCP SBOM Server?

The MCP SBOM Server is a tool based on the Model Context Protocol (MCP) that performs Trivy security scans and generates Software Bill of Materials (SBOMs) compliant with the CycloneDX standard. This tool aims to help developers and security teams better understand the security and compliance of their software dependencies.

How to use the MCP SBOM Server?

First, ensure that the necessary dependencies, such as uv, trivy, and Node.js, are installed. Then, specify the server address in the configuration file and start the server using the command. Finally, call the server in the MCP client to obtain the SBOM report.

Applicable Scenarios

Suitable for enterprise - level project development environments that need to quickly generate software dependency lists, especially for scenarios that require supply - chain transparency.

Main Features

Support for Multiple Programming Languages
Capable of detecting dependencies of multiple programming languages, including but not limited to Python, JavaScript, etc.
Generate Standardized SBOMs
Generate SBOM files compliant with the CycloneDX standard for easy integration with other tools.
High - Performance Scanning
Leverage Trivy's powerful scanning engine to quickly identify potential security vulnerabilities.
Advantages
Efficiently and accurately generate SBOM files.
Support multiple languages and various frameworks.
Easy to integrate into existing CI/CD processes.
Limitations
Requires the installation of multiple dependencies to work properly.
May take more time to complete the scan for very large projects.

How to Use

Install Dependencies
Ensure that uv, trivy, and Node.js are installed.
Configure the Server
Add the MCP server address to the configuration file.
Start the Server
Run the command to start the MCP SBOM Server.

Usage Examples

Generate an SBOM for a Python Project
Perform a security scan on a Python project and generate an SBOM.
Integrate into the CI/CD Pipeline
Automatically trigger SBOM generation in the CI/CD pipeline.

Frequently Asked Questions

How to check if trivy is successfully installed?
Why is my scan so slow?

Related Resources

MCP SBOM GitHub Repository
The official GitHub repository containing source code and documentation.
Trivy Official Documentation
Details the functions and usage of Trivy.
CycloneDX Official Website
Learn about the CycloneDX standard and its applications.

Installation

Copy the following command to your Client for configuration
"mcpServers": {
        "mcp-sbom": {
            "command": "uv",
            "args": [
                "--directory",
                "/path/to/mcp-sbom",
                "run",
                "mcp-sbom"
            ]
        }
    }
Note: Your key is sensitive information, do not share it with anyone.

Alternatives

V
Vestige
Vestige is an AI memory engine based on cognitive science. By implementing 29 neuroscience modules such as prediction error gating, FSRS - 6 spaced repetition, and memory dreaming, it provides long - term memory capabilities for AI. It includes a 3D visualization dashboard and 21 MCP tools, runs completely locally, and does not require the cloud.
Rust
9.4K
4.5 points
M
Moltbrain
MoltBrain is a long-term memory layer plugin designed for OpenClaw, MoltBook, and Claude Code, capable of automatically learning and recalling project context, providing intelligent search, observation recording, analysis statistics, and persistent storage functions.
TypeScript
9.0K
4.5 points
B
Bm.md
A feature-rich Markdown typesetting tool that supports multiple style themes and platform adaptation, providing real-time editing preview, image export, and API integration capabilities
TypeScript
15.8K
5 points
S
Security Detections MCP
Security Detections MCP is a server based on the Model Context Protocol that allows LLMs to query a unified security detection rule database covering Sigma, Splunk ESCU, Elastic, and KQL formats. The latest version 3.0 is upgraded to an autonomous detection engineering platform that can automatically extract TTPs from threat intelligence, analyze coverage gaps, generate SIEM-native format detection rules, run tests, and verify. The project includes over 71 tools, 11 pre-built workflow prompts, and a knowledge graph system, supporting multiple SIEM platforms.
TypeScript
6.7K
4 points
P
Paperbanana
Python
8.9K
5 points
B
Better Icons
An MCP server and CLI tool that provides search and retrieval of over 200,000 icons, supports more than 150 icon libraries, and helps AI assistants and developers quickly obtain and use icons.
TypeScript
9.7K
4.5 points
A
Assistant Ui
assistant - ui is an open - source TypeScript/React library for quickly building production - grade AI chat interfaces, providing composable UI components, streaming responses, accessibility, etc., and supporting multiple AI backends and models.
TypeScript
10.0K
5 points
A
Apify MCP Server
The Apify MCP Server is a tool based on the Model Context Protocol (MCP) that allows AI assistants to extract data from websites such as social media, search engines, and e-commerce through thousands of ready-to-use crawlers, scrapers, and automation tools (Apify Actors). It supports OAuth and Skyfire proxy payment and can be integrated into MCP clients such as Claude and VS Code through HTTPS endpoints or local stdio.
TypeScript
9.7K
5 points
N
Notion Api MCP
Certified
A Python-based MCP Server that provides advanced to-do list management and content organization functions through the Notion API, enabling seamless integration between AI models and Notion.
Python
24.8K
4.5 points
G
Gitlab MCP Server
Certified
The GitLab MCP server is a project based on the Model Context Protocol that provides a comprehensive toolset for interacting with GitLab accounts, including code review, merge request management, CI/CD configuration, and other functions.
TypeScript
28.3K
4.3 points
M
Markdownify MCP
Markdownify is a multi-functional file conversion service that supports converting multiple formats such as PDFs, images, audio, and web page content into Markdown format.
TypeScript
38.0K
5 points
D
Duckduckgo MCP Server
Certified
The DuckDuckGo Search MCP Server provides web search and content scraping services for LLMs such as Claude.
Python
81.3K
4.3 points
U
Unity
Certified
UnityMCP is a Unity editor plugin that implements the Model Context Protocol (MCP), providing seamless integration between Unity and AI assistants, including real - time state monitoring, remote command execution, and log functions.
C#
37.3K
5 points
F
Figma Context MCP
Framelink Figma MCP Server is a server that provides access to Figma design data for AI programming tools (such as Cursor). By simplifying the Figma API response, it helps AI more accurately achieve one - click conversion from design to code.
TypeScript
70.4K
4.5 points
G
Gmail MCP Server
A Gmail automatic authentication MCP server designed for Claude Desktop, supporting Gmail management through natural language interaction, including complete functions such as sending emails, label management, and batch operations.
TypeScript
24.9K
4.5 points
C
Context7
Context7 MCP is a service that provides real-time, version-specific documentation and code examples for AI programming assistants. It is directly integrated into prompts through the Model Context Protocol to solve the problem of LLMs using outdated information.
TypeScript
106.7K
4.7 points
AIBase
Zhiqi Future, Your AI Solution Think Tank
English简体中文繁體中文にほんご
© 2026AIBase