MCP SBOM Server
About
Performs a Trivy scan to produce a Software Bill of Materials (SBOM) in CycloneDX format.
Details
- Author
- gkhays
- GitHub stars
- 3
- Downloads
- 298
- Categories
- Developer Tools, Security, Infrastructure, Other
Jump to
- Performs Trivy scans to generate SBOMs
- Outputs SBOMs in CycloneDX format
- Built with Python 3.12 and MCP 1.6
- Debuggable via MCP Inspector
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
MCP SBOM ServerCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Install the prerequisites: uv, trivy, and Node.js. Configure your MCP client with the JSON entry shown in the README, pointing the --directory argument to the server location. Synchronize dependencies with uv sync, then use the MCP client to invoke the server.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"mcp sbom server": {
"mcp-sbom": {
"command": "uv",
"args": [
"--directory",
"/path/to/mcp-sbom",
"run",
"mcp-sbom"
]
}
}
}
}McpServers
{
"mcp-sbom": {
"command": "uv",
"args": [
"--directory",
"/path/to/mcp-sbom",
"run",
"mcp-sbom"
]
}
}Performs a Trivy scan to produce a Software Bill of Materials (SBOM) in CycloneDX format.
MCP server to perform a Trivy scan and produce an SBOM in CycloneDX format.
"mcpServers": { "mcp-sbom": { "command": "uv", "args": [ "--directory", "/path/to/mcp-sbom", "run", "mcp-sbom" ] } }
- Synchronize dependencies and update the lockfile.
npx @modelcontextprotocol/inspector uv --directory /path/to/mcp-sbom run mcp-sbom
When running on Windows, use paths of the style:
C:/Users/gkh/src/mcp-sbom-server/src/mcp_sbom
This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.
Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning with Cycode.
Enable AI agents to secure code with Semgrep.
An engineering governance and safety control plane for AI coding agents to enforce strict SDLC discipline, quality gates, and security branch protections.
AI-powered security scanning. Scans code, files, and git diffs for vulnerabilities in real-time using the Armis scanning API.
MCP server that vets LLM-emitted shell commands BEFORE execution. 30 detection rules across destructive file ops, package managers, system, database, git, network, exfiltration, privilege escalation. Sub-second, local, free.
Give your coding agent the dependency graph it is about to change: scan a source tree, SBOM, Git ref, or container image; explain why a package is present; diff two graphs; check findings against policy.
BoostSecurity MCP acts as a safeguard preventing agents from adding vulnerable packages into projects. It analyzes every package an AI agent introduces, flags unsafe dependencies, and recommends secure, maintained alternatives to keep projects protected.
A secure MCP server for executing controlled command-line operations with comprehensive security features.
Access the Codacy API to analyze code quality, coverage, and security for your repositories.
Execute pre-approved shell commands securely on a server.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
