AI CodeOps

CycloneDX SBOM validator

Check a CycloneDX JSON SBOM against the structure rules of spec 1.4, 1.5, 1.6: required fields, allowed properties, component types, licenses, hashes and dependency references. The file is checked in your browser and never uploaded.

What it checks

The rules come from the official CycloneDX JSON schemas, bom-1.4.schema.json, bom-1.5.schema.json and bom-1.6.schema.json, published under the Apache License 2.0 in the CycloneDX specification repository. The file's specVersion picks the rule set. Errors are schema rules:

  • The document. bomFormat is CycloneDX; specVersion is present; in 1.4, version is required too. No properties the schema doesn't define at the top level. serialNumber is urn:uuid: plus a lowercase UUID, and version is an integer (1 or more from 1.5).
  • Metadata. Only the schema's properties, and timestamp is an RFC 3339 date-time. metadata.component is checked like any component.
  • Components, nested ones included. type and name are required; type is one the spec version allows (machine-learning-model and data arrived in 1.5, cryptographic-asset in 1.6); scope is required, optional or excluded; no properties the schema doesn't define.
  • Licenses. Each license object has exactly one of id or name. From 1.5, a licenses list is either license objects or exactly one SPDX expression, not both. 1.4 allowed them side by side.
  • Hashes. alg is one of the schema's algorithms (MD5 to BLAKE3) and content is a hex digest of 32, 40, 64, 96 or 128 characters.
  • External references have a url and a type from the version's list.
  • Dependencies have a ref, and dependsOn lists no ref twice.

Warnings are things the schema allows but the spec's text or common tools don't:

  • A bom-ref used twice. The spec says every bom-ref must be unique within the BOM, but a JSON schema can't enforce that.
  • A dependency that points at a bom-ref no component, service or license in the file has.
  • A purl that doesn't start with pkg:.

Not checked: the fields of services beyond their name, vulnerabilities, compositions, formulation, annotations, declarations, definitions and signatures, and whether license IDs are real SPDX IDs. For a full JSON Schema validation, use the CycloneDX CLI's validate command.

Privacy: the file stays in your browser

The page reads the file with your browser's file API and checks it with JavaScript on this page. It makes no network request with the file or anything in it, and stores nothing.

More SBOM tools

In AI CodeOps, SBOMs are recorded per project and checked by the release gate; see Security and SBOM and SBOM and security. For the background, read What is software supply chain security?

Embed this validator

Paste this snippet into your own page or docs. The framed copy shows only the validator, with a link back here, and is kept out of search results.

<iframe src="https://aicodeops.dev/tools/cyclonedx-validator?embed=1" title="CycloneDX validator" width="100%" height="640" style="border:0" loading="lazy"></iframe>
<p><a href="https://aicodeops.dev/tools/cyclonedx-validator">CycloneDX validator</a> by <a href="https://aicodeops.dev/">AI CodeOps</a></p>

Frequently asked questions

Is my SBOM uploaded anywhere?

No. The file is read and checked in your browser, and the page sends no request with it. Nothing is stored.

Is this a full JSON Schema validation?

No. It checks the parts of the official CycloneDX 1.4, 1.5 and 1.6 JSON schemas that SBOM tools most often get wrong: the document's required and allowed properties, components, licenses, hashes, external references and dependencies. Services are only checked for a name, and vulnerabilities, formulation, declarations and signatures are not checked. For a full validation, use the CycloneDX CLI's validate command.

Why does a file pass here and fail elsewhere, or the reverse?

Because this tool checks a stated subset of the schema, and warns about a few things the schema allows but the spec's text doesn't, such as duplicate bom-refs. Errors are schema rules; warnings are not.

Does it support CycloneDX 1.7, XML or SPDX?

Not yet. It checks CycloneDX JSON documents with specVersion 1.4, 1.5 or 1.6. Other spec versions are reported as not checked.

Do I need an account?

No. The validator is free and works without signing in.