npm-mcp

Instructions

Implementation Reference

• src/index.ts:788-813 (handler)

  Implementation of the "sbom" MCP tool, which generates a Software Bill of Materials using the `npm sbom` command.

  server.tool(
    "sbom",
    "Generate a Software Bill of Materials (SBOM) for a project",
    {
      path: z.string().describe("Absolute path to the package directory"),
      format: z
        .enum(["cyclonedx", "spdx"])
        .optional()
        .describe("SBOM format (default: cyclonedx)"),
      production: z.boolean().optional().describe("Only include production dependencies"),
    },
    async ({ path, format, production }) => {
      const args = ["sbom"];
      if (format) args.push(`--sbom-format=${format}`);
      if (production) args.push("--omit=dev");
      try {
        const { stdout } = await run(args, path);
        return { content: [{ type: "text", text: stdout }] };
      } catch (e: any) {
        return {
          content: [{ type: "text", text: `Error: ${e.stderr || e.message}` }],
          isError: true,
        };
      }
    },
  );