Skip to main content
Glama
Sign In
enesjakozh
MCP SBOM Server

MCP SBOM Server

by gkhays
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

MCP SBOM Server

Python MCP

MCP server to perform a Trivy scan and produce an SBOM in CycloneDX format.

Installation

Prerequisites

Install the following.

Related MCP server: MCP NVD Server

MCP Clients

Configuration

"mcpServers": {
        "mcp-sbom": {
            "command": "uv",
            "args": [
                "--directory",
                "/path/to/mcp-sbom",
                "run",
                "mcp-sbom"
            ]
        }
    }

Building

NOTE

This project employsuv.

  1. Synchronize dependencies and update the lockfile.

uv sync

Debugging

MCP Inspector

Use MCP Inspector.

Launch the MCP Inspector as follows:

npx @modelcontextprotocol/inspector uv --directory /path/to/mcp-sbom run mcp-sbom

MCP Inspector

Windows

When running on Windows, use paths of the style:

C:/Users/gkh/src/mcp-sbom-server/src/mcp_sbom

Available Tools

1 tool
scanC
Execute Trivy scanner to generate SPDX SBOM for a container image.
Supports the SPDX JSON format.

Args:
    image (str): The container image name/reference to scan

Returns:
    str: Test response or error message

Inputs: image (required).

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

    TDQS

    B3.1/5.0

    Scored across 1 tool

    Disambiguation5/5

    With only one tool, there is no possibility of confusion or overlap between tools. The single 'scan' tool has a clearly defined purpose of generating SPDX SBOMs for container images using Trivy scanner.

    Naming Consistency5/5

    With a single tool, naming consistency is inherently perfect. The tool name 'scan' follows a clear verb-based naming pattern that accurately describes its function without any conflicting naming conventions to compare against.

    Tool Count2/5

    A single tool for an SBOM server feels insufficient for the apparent domain scope. While scanning is a core function, SBOM management typically involves additional operations like listing, retrieving, comparing, or validating SBOMs. The server appears to have significant functional gaps beyond the basic scan capability.

    Completeness2/5

    The tool surface is severely incomplete for an SBOM server. While scanning is essential, there are obvious gaps in the lifecycle: no tools for retrieving stored SBOMs, comparing different SBOM versions, validating SBOM formats, or managing SBOM metadata. This limited surface will likely cause agent failures when trying to perform comprehensive SBOM workflows.

    Maintenance

    ActivityInactive
    ResponsivenessNo recent community issues

    Resources

    Related MCP Connectors

    Related MCP Servers

    • Snyk MCP Server

      sammcj
      F
      license
      Not graded
      quality
      F
      maintenance
      A standalone server enabling Snyk security scanning through the Model Context Protocol, with support for repository and project analysis, token verification, and CLI integration.
      15
      -

    • MCP NVD Server

      gkhays
      A
      license
      B
      quality
      D
      maintenance
      A Model Context Protocol server that retrieves CVE information from the National Vulnerability Database, allowing AI models to access up-to-date vulnerability data.
      1
      7
      Apache 2.0

    • MCP Vulnerability Checker

      firetix
      A
      license
      A
      quality
      D
      maintenance
      A Model Context Protocol server providing security vulnerability intelligence tools including CVE lookup, EPSS scoring, CVSS calculation, exploit detection, and Python package vulnerability checking.
      8
      9
      MIT

    • MCP SBOM Server

      MCP-Mirror
      F
      license
      A
      quality
      Not graded
      maintenance
      Performs vulnerability scans using Trivy to generate Software Bill of Materials (SBOM) in CycloneDX format. It enables automated security auditing and dependency tracking through the Model Context Protocol.
      1
      -

    Appeared in Searches