CycloneDX SBOM viewer

Open or paste a CycloneDX JSON software bill of materials to browse its components, versions and licenses. The file is read in your browser and never uploaded.

How to use it

1. Export your SBOM as CycloneDX JSON from the tool you already use in your build. The file picker accepts .json and .cdx.json files.
2. Choose the file, or paste its JSON into the box. A pasted SBOM is read when you leave the box, for example by clicking outside it.
3. Read the summary line: the CycloneDX spec version, the software the SBOM describes and how many components it lists.
4. Type in Filter to narrow the table. It matches a component's name, version, licenses and package URL, ignoring case, so MIT, GPL or pkg:npm are all useful searches.

Which CycloneDX fields it reads

The viewer accepts any JSON document with "bomFormat": "CycloneDX", whatever its spec version. It doesn't validate the file against the CycloneDX schema (the CycloneDX validator does); it reads these fields and ignores the rest:

• specVersion, shown in the summary line.
• metadata.component.name and version: the software the SBOM describes.
• components, including components nested inside other components. They are flattened into one table, in the order they appear in the file.
• For each component: name, prefixed with its group when it has one (for example @acme/ui), version, type (such as library) and purl, the package URL.
• licenses: for each entry, the SPDX license ID, else the license name, else the license expression (such as Apache-2.0 OR MIT).

Everything else in the file is not shown, including the dependencies section, hashes, services and any vulnerability data. So the table tells you what is in the SBOM, but not which component pulls in which. A component without a name shows as ?, and one without licenses or a package URL shows a dash.

Only JSON is supported. A CycloneDX XML file shows "That isn't valid JSON.", and an SPDX file shows an error saying SPDX isn't supported here yet.

Privacy: the file stays in your browser

The viewer reads the file with your browser's file API and parses it with JavaScript on this page. It makes no network request with the file or anything in it, and it stores nothing: the table lives in the page's memory and is gone when you reload or close the tab. You can check this in your browser's developer tools: no request in the network panel carries the file's contents. No account is needed.

About SBOMs in AI CodeOps

AI CodeOps keeps SBOM records (CycloneDX and SPDX) per project, next to each change's review and tests. It doesn't generate SBOMs: you create them with your own tooling and record each one against the project. A record holds the format and version, the number of components and of vulnerable components, a license summary, the commit it describes, a SHA-256 hash and a link to the SBOM file. The release check your CI calls can deny a change when the project's latest SBOM contains a license you've disallowed, such as GPL-3.0, and a project with no SBOM fails that check too. See SBOM and security, the docs and security at AI CodeOps.

New to SBOMs? What is software supply chain security? explains what an SBOM is for, how CycloneDX and SPDX differ, and how license policy applies to AI-written code.

More SBOM tools

• SBOM diff: compare two SBOMs and see the components added, removed and changed, with version and license changes.
• License compatibility checker: see which component licenses fit your project's license, with a source for each rule.
• CycloneDX validator: check a file's structure against the CycloneDX 1.4–1.6 schema rules.

Embed this viewer

Paste this snippet into your own page or docs. The framed copy shows only the viewer, with a link back here, and is kept out of search results.

<iframe src="https://aicodeops.dev/tools/sbom-viewer?embed=1" title="SBOM viewer" width="100%" height="640" style="border:0" loading="lazy"></iframe>
<p><a href="https://aicodeops.dev/tools/sbom-viewer">SBOM viewer</a> by <a href="https://aicodeops.dev/">AI CodeOps</a></p>