Free tool · No account · Runs on your device
An SBOM is only as
useful as its evidence.
Find the missing details that hold up vulnerability matching and supplier reviews. Get a practical, downloadable checklist in your browser.
Bring your bill of materials.
CycloneDX 1.2–1.7 or SPDX 2.2–2.3 JSON. Up to 2 MiB and 5,000 components. No upload or advisory lookup.
Processed in this tab, kept only in memory. Clear removes the input and result. Downloads may contain component names; review before sharing.
What is missing from the picture?
Load the example or add your SBOM to see component-level evidence gaps and practical next steps.
Read the result correctly
Readiness, not a security verdict.
This tool checks selected structural fields. It does not validate the full SBOM schema, verify hashes, assess dependency relationships, query CVEs or determine regulatory compliance. Missing hashes may be reasonable for some component types. Use the findings as a conversation with your supplier or build team.