generate_sbom
Create a CycloneDX v1.6 SBOM for Go projects. Parses go.mod and go.sum offline to build a software inventory, fulfilling PCI DSS 6.3.2 requirements.
Instructions
Generate a CycloneDX v1.6 SBOM for a Go project. Default behavior: writes sbom.json (or sbom.xml when format=xml) next to the scanned go.mod and returns metadata only (output_path, size_bytes, component_count, unknown_licenses). Override the destination with output_path (must be absolute). Pass inline=true to return the serialized SBOM in the MCP response instead (capped at 64 KB; returns SBOM_TOO_LARGE above that). Parses go.mod + go.sum offline against the local GOMODCACHE; cache-miss modules surface as UNKNOWN-LICENSE. Satisfies PCI DSS 6.3.2 (software inventory, mandatory since March 2025).
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | required,Absolute path to the Go project directory containing go.mod (and go.sum) | |
| format | No | Output format: json (default) or xml | |
| output_path | No | Absolute path where the SBOM file should be written. Default: {path}/sbom.json or {path}/sbom.xml. Ignored when inline=true. | |
| inline | No | If true, return serialized SBOM inline in the response (64 KB cap, SBOM_TOO_LARGE on overflow). Default: false, write to file and return metadata only. | |
| fixed_serial | No | Override generated serialNumber. Accepts bare UUID v4 or urn:uuid: form. Use for VEX linking and audit pipeline reproducibility. | |
| no_timestamp | No | If true, omit metadata.timestamp for reproducible builds. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | ||
| bom_format | Yes | ||
| spec_version | Yes | ||
| component_count | Yes | ||
| unknown_licenses | No | ||
| format | Yes | ||
| generated_at | Yes | RFC3339 UTC | |
| project_path | Yes | Absolute scanned path | |
| output_path | No | ||
| size_bytes | No | ||
| serialized_bom | No | ||
| fixed_serial | No | Override generated serialNumber (urn:uuid: or bare 36-char form) | |
| no_timestamp | No | Omit metadata.timestamp for reproducible builds |