Inventory Management
Keep an always-current, standardized record of exactly which components make up each piece of software you ship or run.
Software Bill of Materials
Know Every Component in Your Software
Just as a product has a bill of materials listing every part, an SBOM lists every package, library and dependency inside your software — with its name, version, license and a unique identifier. ENOCSI scans a container image, builds the inventory in the CycloneDX standard, and lets you export it as JSON or CSV for security tooling and procurement.
- CycloneDX JSON
- JSON & CSV export
- Quality score 0–100
SBOMcrm-api • completed
spring-boot-starter-web
3.1.4
Apache-2.0maven
jackson-databind
2.15.2
Apache-2.0maven
lodash
4.17.21
MITnpm
openssl
3.0.2
Apache-2.0deb
247
Components
6
Ecosystems
92
Quality
What is an SBOM?
A Standardized Component Record
An SBOM covers the libraries used inside your software — not the external services it talks to. Every record captures the details you need to reason about risk and license obligations.
| Field | Description | Example |
|---|---|---|
| Component | Package name | spring-boot-starter-web |
| Version | Version in use | 3.1.4 |
| Type | Package ecosystem | Maven, npm, pip, go-module |
| License | Terms of use | Apache-2.0, MIT, GPL-3.0 |
| PURL | Universal package identity | pkg:maven/org.springframework.boot/spring-boot@3.1.4 |
| Supplier | Publishing organization | Spring, Meta, Google |
Why it Matters
From Inventory to Instant Answers
Supply-Chain Transparency
Document the precise packages, versions and licenses inside any software you build, buy or receive from a third party.
Compliance-Ready
Many enterprise and government procurement processes now require an SBOM. ENOCSI produces one automatically, in a format they accept.
Instant Impact Analysis
When a new CVE lands on a component, query which projects include it in seconds instead of auditing repositories one by one.
Output & Analysis
Four Ways to Read Your SBOM
Once a scan completes, the result opens across four views — from a raw component table to a quality score that tells you how complete the document is before you hand it to a third party.
Read the SBOM guideComponents
Every detected package and library — name, version, type, license, PURL and supplier — with per-column filtering.
Dependencies
The relationships between components: which packages you pull in directly versus their transitive dependencies.
Licenses
Components grouped by license type, so priority licenses for your compliance policy surface at a glance.
Compliance Metrics
A 0–100 quality score built from component count, ecosystem coverage, and license, hash and supplier coverage.
Export Anywhere
Portable by Design
The CycloneDX JSON drops straight into other SCA tools, vulnerability scanners and procurement systems. Need a human-friendly view? Export CSV and open it in any spreadsheet.
Download JSON
Full CycloneDX document
Download CSV
Component list for spreadsheets
Copy JSON
Straight to your clipboard
Print / PDF
Save as a documentary record
Ship With a Complete Component Record
Generate a CycloneDX SBOM for any container image and export it in seconds.