sbom

Instructions

Implementation Reference

• src/index.ts:799-812 (handler)

  Handler function for the 'sbom' tool. Runs `npm sbom` with optional --sbom-format and --omit=dev flags, returns stdout or error.

  async ({ path, format, production }) => {
    const args = ["sbom"];
    if (format) args.push(`--sbom-format=${format}`);
    if (production) args.push("--omit=dev");
    try {
      const { stdout } = await run(args, path);
      return { content: [{ type: "text", text: stdout }] };
    } catch (e: any) {
      return {
        content: [{ type: "text", text: `Error: ${e.stderr || e.message}` }],
        isError: true,
      };
    }
  },

• src/index.ts:791-798 (schema)

  Zod schema for the 'sbom' tool: path (string), format (optional 'cyclonedx' | 'spdx'), production (optional boolean).

  {
    path: z.string().describe("Absolute path to the package directory"),
    format: z
      .enum(["cyclonedx", "spdx"])
      .optional()
      .describe("SBOM format (default: cyclonedx)"),
    production: z.boolean().optional().describe("Only include production dependencies"),
  },

• src/index.ts:788-813 (registration)

  Registration of the 'sbom' tool on the main MCP server with name 'sbom' and description 'Generate a Software Bill of Materials (SBOM) for a project'.

  server.tool(
    "sbom",
    "Generate a Software Bill of Materials (SBOM) for a project",
    {
      path: z.string().describe("Absolute path to the package directory"),
      format: z
        .enum(["cyclonedx", "spdx"])
        .optional()
        .describe("SBOM format (default: cyclonedx)"),
      production: z.boolean().optional().describe("Only include production dependencies"),
    },
    async ({ path, format, production }) => {
      const args = ["sbom"];
      if (format) args.push(`--sbom-format=${format}`);
      if (production) args.push("--omit=dev");
      try {
        const { stdout } = await run(args, path);
        return { content: [{ type: "text", text: stdout }] };
      } catch (e: any) {
        return {
          content: [{ type: "text", text: `Error: ${e.stderr || e.message}` }],
          isError: true,
        };
      }
    },
  );

• src/index.ts:26-38 (helper)

  Helper function `run` that executes npm commands via execFile with timeout, large buffer, NO_COLOR env, and optional cwd. Used by the sbom handler.

  async function run(
    args: string[],
    cwd?: string,
  ): Promise<{ stdout: string; stderr: string }> {
    const fullArgs = [...args, ...npmrcArgs];
    const opts: { cwd?: string; timeout: number; env: NodeJS.ProcessEnv; maxBuffer: number } = {
      timeout: 120_000,
      maxBuffer: 10 * 1024 * 1024, // 10MB buffer for large outputs
      env: { ...process.env, NO_COLOR: "1" },
    };
    if (cwd) opts.cwd = cwd;
    return exec(NPM, fullArgs, opts);
  }

• src/index.ts:1366-1370 (registration)

  Registration of the 'sbom' tool in the sandbox server (a read-only simulation server), with a noop handler.

  sandbox.tool("sbom", "Generate a Software Bill of Materials", {
    path: z.string().describe("Absolute path to the package directory"),
    format: z.enum(["cyclonedx", "spdx"]).optional().describe("SBOM format"),
    production: z.boolean().optional().describe("Only include production dependencies"),
  }, noop);