CLI reference — sbomlyze

Usage

sbomlyze <sbom1|-> [sbom2|-] [options]
sbomlyze convert <sbom|-> --to <format> [-o out]

Modes:
  Single file:  sbomlyze <sbom> [--json]
  Interactive:  sbomlyze <sbom> -i
  Convert:      sbomlyze convert <sbom> --to <fmt>
  Web server:   sbomlyze -web [--port 8080]
  Two files:    sbomlyze <sbom1> <sbom2> [...]

Quick start

sbomlyze before.json after.json
sbomlyze image.json
sbomlyze image.json --compliance
sbomlyze image.json -i
sbomlyze -web
sbomlyze convert syft.json --to spdx
sbomlyze before.json after.json --format sarif
sbomlyze before.json after.json --policy policy.json

Options

-i, --interactive Interactive TUI explorer

-web, --web Start the web UI server

--port <port> Web server port (default 8080)

--json Shorthand for --format json

--format <format> text, json, sarif, junit, markdown, html, patch

--compliance Show NTIA / CISA / BSI compliance scoring

--policy <file> Policy file for CI checks

--strict Fail on parse warnings

--tolerant Continue on parse warnings (default)

--no-pager Disable automatic paging of output

--to <format> Target format for convert: cyclonedx (cdx), spdx, syft

-o, --output <file> Output file for convert (default stdout)

--version, -v Show version information

--help, -h Show the help message

Output formats

Seven formats, all produced from the same analysis.

Format	Flag	Description	Best for
text	--format text (default)	Human-readable terminal output	Local inspection
json	--json	Structured JSON	CI pipelines, scripting
sarif	--format sarif	SARIF 2.1.0 with integrity-drift, deep-dependency, new/removed-component, version-change, and policy-violation rules	GitHub Code Scanning
junit	--format junit	JUnit XML test cases for drift, depth, and each policy violation	CI test dashboards
markdown	--format markdown	Side-by-side comparison table, key findings, and collapsible package sections	Pull request comments
html	--format html	Single self-contained file with inline CSS and JS, no external assets	Auditors, sharable reports
patch	--format patch	RFC 6902 JSON Patch operations representing the diff	Programmatic patching

Policy engine

sbomlyze exits with code 1 when violations occur. Setting any min_*_score threshold automatically triggers compliance evaluation, even without --compliance.

policy.json

{
  "max_added": 10,
  "max_removed": 5,
  "max_changed": 100,
  "deny_licenses": ["GPL-3.0", "AGPL-3.0"],
  "require_licenses": true,
  "deny_duplicates": true,
  "deny_integrity_drift": true,
  "max_depth": 3,
  "warn_supplier_change": true,
  "warn_new_transitive": true,
  "min_ntia_score": 85,
  "min_cisa_score": 70,
  "min_bsi_score": 80,
  "min_overall_compliance": 75
}

max_added Maximum new components allowed (0 = unlimited)

max_removed Maximum removed components allowed

max_changed Maximum changed components allowed

deny_licenses Forbidden licence identifiers

require_licenses Require all added components to have licences

deny_duplicates Fail if duplicate packages exist in the result

deny_integrity_drift Fail if a hash changed without a version change

max_depth Fail if new transitive dependencies reach depth ≥ N

warn_supplier_change Warn, not fail, if a supplier or author changed

warn_new_transitive Warn on any new transitive dependencies

min_ntia_score Fail below this NTIA score (0–100)

min_cisa_score Fail below this CISA score (0–100)

min_bsi_score Fail below this BSI score (0–100)

min_overall_compliance Fail below this overall score (0–100)

Component identity matching

Components are matched by precedence, so cross-format comparison works without identical document layouts.

1 PURL pkg:npm/lodash

2 CPE cpe:vendor:product

3 BOM-ref / SPDXID ref:component-123

4 Namespace + name com.example/mypackage

5 Name simple-package

Exit codes

0

Success. No differences or violations.

1

Differences found, policy violations, or errors. In diff mode, any component change returns 1 — usable as a plain “did anything change?” gate.

Supported formats

Syft (native)

"artifacts" + one of "source", "distro", "descriptor"

CycloneDX

"bomFormat": "CycloneDX", or a cyclonedx $schema

SPDX

"spdxVersion" starting with "SPDX-"

All formats must be JSON. XML support is not currently available.