SBOMApp
SBOMApp helps enterprises generate, analyze, govern, remediate, and share software bills of materials across the development lifecycle.
What SBOMApp is
SBOMApp helps enterprises generate, analyze, govern, remediate, and share software bills of materials across the development lifecycle. It creates SBOMs from source code, containers, and binaries in SPDX 3.0 and CycloneDX 1.7 formats. Analysis covers direct and transitive dependencies, CVEs, licenses, and build drift. SBOM App Core adds role-based access control, encrypted report links with access controls, and policy-as-code validation across builds. Listed connections and workflows include GitHub, GitLab, Bitbucket, Jenkins, a REST API, and an AI-native MCP. Open-source metadata integrations support license visibility and end-of-life detection. Deployment choices include on-premises, SaaS, AWS and Azure marketplaces, and MCP server. The Air-Gapped Edition can run on premises in Kubernetes, on bare metal, or on a virtual machine without outbound connectivity. The product also lists SSO, audit logs, and end-to-end encryption for sharing. AI Code Insight identifies dependencies, vulnerabilities, licenses, and risks in AI-assisted development workflows, including through a VS Code MCP server. Pricing is on request and varies by application volume, deployment, security capabilities, integrations, compliance, and support.
Good
- Generates SPDX 3.0 and CycloneDX 1.7 SBOMs.
- Analyzes dependencies, CVEs, licenses, and build drift.
- Offers on-premises and air-gapped deployment options.
- Includes policy-as-code validation across builds.
- Pricing can be tailored to support and service requirements.
Watch out
- Pricing is available on request.
- Deployment and pricing depend on application and security requirements.
Who it suits
SBOMApp is aimed at DevSecOps teams managing software supply-chain inventories and controls. Its air-gapped edition is intended for defense, government, and regulated healthcare.
Verdict
SBOMApp covers SBOM creation, analysis, governance, and sharing, with deployment choices ranging from SaaS to air-gapped on-premises. Request pricing to establish which configuration and support options fit your requirements.
Plans and prices
From SBOMApp's own pricing page, checked 2 Oct 2001.
| Plan | Price | What it gives you |
|---|---|---|
| Custom enterprise quote | Priced on request | Pricing varies by application volume · deployment · security capabilities · integrations · compliance · support |
The facts
Each one read from SBOMApp's own pages, with the date it was checked.
What it does
- AI code insight
- Its AI Code Insight feature identifies dependencies, vulnerabilities, licenses, and risks in AI-assisted development workflows, including through a VS Code MCP server.checked 2 Oct 2001
- Analysis
- The product can generate SBOMs from source, containers, and binaries, map direct and transitive dependencies, scan for CVEs, manage licenses, and detect build drift.checked 2 Oct 2001
- Data handling
- For the MCP product, the company says it does not store source code, SBOMs, dependencies, or project data, and uses token-based access and HTTPS communication.checked 2 Oct 2001
- Governance
- SBOM App Core provides role-based access control, encrypted access-controlled report links, and policy-as-code validation across builds.checked 2 Oct 2001
- Integrations
- The site lists GitHub, GitLab, Bitbucket, Jenkins, REST API, and an AI-native MCP among its supported integrations and workflows.checked 2 Oct 2001
- Open-source data
- The product describes integration with the GitHub API, ClearlyDefined, and open-source metadata sources for license visibility and end-of-life detection.checked 2 Oct 2001
- Purpose
- SBOM App helps enterprises generate, analyze, govern, remediate, and securely share software bills of materials across the software development lifecycle.checked 2 Oct 2001
- Release options
- The site lists on-premises, SaaS, AWS and Azure marketplace, and MCP server deployment models.checked 2 Oct 2001
- SBOM formats
- It supports SBOM generation in SPDX 3.0 and CycloneDX 1.7 formats.checked 2 Oct 2001
- Security
- The site says SBOM App offers secure sharing with role-based access and end-to-end encryption, plus built-in SSO and audit logs.checked 2 Oct 2001
- Support
- Pricing is customized to support and service requirements, with standard support, priority support, onboarding, and dedicated assistance listed as options.checked 2 Oct 2001
- Who it is for
- The company describes SBOM App as built for DevSecOps teams and says its air-gapped edition is intended for defense, government, and regulated healthcare.checked 2 Oct 2001
Where it runs
- Air-gapped deployment
- The Air-Gapped Edition is described as deployable on premises in Kubernetes, bare metal, or a virtual machine with zero outbound connectivity.checked 2 Oct 2001
The company
- Company
- SBOM App is a product of IARM Information Security.checked 2 Oct 2001
Alternatives to SBOMApp
- 1
Keysight Eggplant Test
AndroidiOSWebAPI7.9$9,999, paid once - 2
Sonatype Nexus Repository
Free planWebAPILinuxmacOS7.8From $162.50 a month - 3
Ortelius
Free planWebAPISelf-hosted7.1From $40 a month - 4
sbomify
Free planWebAPILinuxmacOS7.0From $159 a month - 5
FOSSA
Free planWebAPILinuxSelf-hosted6.9From $168,392.50 a month - 6
ReARM
Free planWebAPISelf-hosted6.9From $75 a month