SBOM Field Check - CycloneDX and SPDX against the CRA 2026 bar
Names every missing field in your CycloneDX or SPDX SBOM against BSI TR-03183-2 and the CISA 2026 minimum elements. 34 rules. Runs offline.
In the full version
- Every SBOM in the repo, not just the open file
- An evidence file you keep (CSV, JSON or HTML)
- Machine-readable output for CI
- Re-checks every time the SBOM is regenerated