The safeguards map / 1.1 Code and dependencies
cdxgen (CycloneDX Generator)
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
A command-line tool, library and server that generates CycloneDX bills of materials for software, container images and AI/ML assets.
Where it sits
1.1 Code and dependencies (primary): Generates CycloneDX bills of materials from source projects and container images, and AI/ML bills of materials covering prompt files, Model Context Protocol (MCP) configs and model metadata.
Software (SBOM) - For many languages and container images.
captured
AI/ML (AI-BOM) - For prompt files, AI services, MCP configs, and model metadata
captured
Facts
- Concern
- security
- Names the law
- no
- Subject
- softwareAI system
- Used by
- those who make itthose who distribute it
- Runs
- by handin CI
Handoffs
produces Software and AI inventory: CycloneDX JSON, SPDX 3.0.1 JSON-LD
Collector's note
The OWASP project page lists cdxgen as an "other" project with no level, so the level comes from the project's own README. The CycloneDX format itself is an artifact, not an entry.
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.