MCP SBOM Server
# MCP SBOM Server
[](https://www.python.org/)
[](https://www.anthropic.com/news/model-context-protocol)
MCP server to perform a Trivy scan and produce an SBOM in CycloneDX format.
## Installation
### Prerequisites
Install the following.
- [uv](https://github.com/astral-sh/uv)
- [trivy](https://github.com/aquasecurity/trivy)
- [Node.js](https://nodejs.org/en)
## MCP Clients
### Configuration
```json
"mcpServers": {
"mcp-sbom": {
"command": "uv",
"args": [
"--directory",
"/path/to/mcp-sbom",
"run",
"mcp-sbom"
]
}
}
```
## Building
> [!NOTE]
> This project employs `uv`.
1. Synchronize dependencies and update the lockfile.
```
uv sync
```
## Debugging
### MCP Inspector
Use [MCP Inspector](https://github.com/modelcontextprotocol/inspector).
Launch the MCP Inspector as follows:
```
npx @modelcontextprotocol/inspector uv --directory /path/to/mcp-sbom run mcp-sbom
```
### Windows
When running on Windows, use paths of the style:
```console
C:/Users/gkh/src/mcp-sbom-server/src/mcp_sbom
```
TDQS
Scored across 1 tool
With only one tool, there is no possibility of confusion or overlap between tools. The single 'scan' tool has a clearly defined purpose of generating SPDX SBOMs for container images using Trivy scanner.
With a single tool, naming consistency is inherently perfect. The tool name 'scan' follows a clear verb-based naming pattern that accurately describes its function without any conflicting naming conventions to compare against.
A single tool for an SBOM server feels insufficient for the apparent domain scope. While scanning is a core function, SBOM management typically involves additional operations like listing, retrieving, comparing, or validating SBOMs. The server appears to have significant functional gaps beyond the basic scan capability.
The tool surface is severely incomplete for an SBOM server. While scanning is essential, there are obvious gaps in the lifecycle: no tools for retrieving stored SBOMs, comparing different SBOM versions, validating SBOM formats, or managing SBOM metadata. This limited surface will likely cause agent failures when trying to perform comprehensive SBOM workflows.