Sbom Tools

sbom工具

MCP服务器，用于创建、合并和区分SBOM（软件物料清单）。支持CycloneDX 1.5和SPDX 2.3格式。

特性

• sbom_from_dependence：从依赖关系列表创建SBOM
• sbom_merge：通过重复数据删除合并多个SBOM
• sbom_diff：比较SBOM以查找添加、删除和更改的组件

安装

npm install
npm run build

用法

作为MCP服务器（stdio）

npm start

或者使用npx：

npx sbom-tools

作为MCP服务器（HTTP）

npm start -- --transport=http

Claude桌面配置

添加到您的Claude桌面配置(~/.config/claude/claude_desktop_config.json):

{
  "mcpServers": {
    "sbom-tools": {
      "command": "node",
      "args": ["/path/to/sbom-tools/dist/cli.js"]
    }
  }
}

工具

sbom_from_dependence

从依赖关系列表创建SBOM。

输入：

{
  "deps": [
    {
      "ecosystem": "npm",
      "name": "lodash",
      "version": "4.17.21",
      "license": "MIT"
    },
    {
      "ecosystem": "pypi",
      "name": "requests",
      "version": "2.31.0"
    }
  ],
  "format": "cyclonedx"
}

输出（CycloneDX）：

{
  "ok": true,
  "data": {
    "sbom": {
      "bomFormat": "CycloneDX",
      "specVersion": "1.5",
      "version": 1,
      "serialNumber": "urn:uuid:...",
      "metadata": {
        "timestamp": "2024-01-15T10:00:00.000Z",
        "tools": [{"vendor": "Dedalus Labs", "name": "sbom-tools", "version": "1.0.0"}]
      },
      "components": [
        {
          "type": "library",
          "name": "lodash",
          "version": "4.17.21",
          "purl": "pkg:npm/lodash@4.17.21",
          "licenses": [{"license": {"id": "MIT"}}]
        },
        {
          "type": "library",
          "name": "requests",
          "version": "2.31.0",
          "purl": "pkg:pypi/requests@2.31.0"
        }
      ]
    }
  },
  "meta": {
    "source": "sbom-tools",
    "retrieved_at": "2024-01-15T10:00:00.000Z",
    "pagination": {"next_cursor": null},
    "warnings": []
  }
}

sbom_merge

将多个SBOM合并为一个，按名称和版本对组件进行重复数据删除。

输入：

{
  "sboms": [
    {"bomFormat": "CycloneDX", "specVersion": "1.5", ...},
    {"spdxVersion": "SPDX-2.3", ...}
  ],
  "format": "cyclonedx"
}

输出：

{
  "ok": true,
  "data": {
    "sbom": {
      "bomFormat": "CycloneDX",
      "specVersion": "1.5",
      "components": [...]
    }
  },
  "meta": {...}
}

sbom_diff

比较两个SBOM并返回差异。

输入：

{
  "old_sbom": {"bomFormat": "CycloneDX", ...},
  "new_sbom": {"bomFormat": "CycloneDX", ...}
}

输出：

{
  "ok": true,
  "data": {
    "added": [
      {"name": "axios", "newVersion": "1.6.0", "ecosystem": "npm"}
    ],
    "removed": [
      {"name": "moment", "oldVersion": "2.29.4", "ecosystem": "npm"}
    ],
    "version_changed": [
      {"name": "lodash", "oldVersion": "4.17.20", "newVersion": "4.17.21", "ecosystem": "npm"}
    ]
  },
  "meta": {...}
}

响应信封

所有回复均遵循标准的Dedalus回复信封：

成功：

{
  "ok": true,
  "data": {...},
  "meta": {
    "source": "sbom-tools",
    "retrieved_at": "ISO-8601 timestamp",
    "pagination": {"next_cursor": null},
    "warnings": []
  }
}

错误：

{
  "ok": false,
  "error": {
    "code": "INVALID_INPUT | INTERNAL_ERROR | ...",
    "message": "Human readable message",
    "details": {}
  },
  "meta": {
    "retrieved_at": "ISO-8601 timestamp"
  }
}

支持格式

CycloneDX 1.5

专注于组件的最小模式：

• bomFormat：“CycloneDX”
• specVersion: "1.5"
• version: 1
• serialNumber：UUID
• metadata.timestamp：ISO-8601
• metadata.tools：工具信息
• components[]：带有名称、版本、檩条和许可证的库组件

SPDX 2.3

专注于包的最小模式：

• spdxVersion：“SPDX-2.3”
• dataLicense：“CC0-1.0”
• SPDXID：“SPDX参考文件”
• documentNamespace：唯一URI
• creationInfo：时间戳和创建者
• packages[]：包含名称、版本、SPDXID、许可证、外部引用的包

发展

# Install dependencies
npm install

# Run in development mode
npm run dev

# Run tests
npm test

# Run tests with coverage
npm run test:coverage

# Build for production
npm run build

# Type check
npm run typecheck

环境变量

许可证

麻省理工学院