{"uid":"cap_P2Srp1R0krD3oezr89m_L","slug":"sicher-sbom-generator-ce83f509","name":"Sicher SBOM Generator","description":"Parses package-lock.json, package.json, requirements.txt, go.mod and Cargo.lock and emits a bill of materials in CycloneDX 1.5 or SPDX 2.3, with a package URL per component. The distinction that decides whether the document is worth anything is made explicit: a lockfile names the versions actually installed, a manifest only names ranges, and a bill of materials built from ranges describes what might be installed rather than what is.","url":"https://sicher.halowerk.com/v1/sbom?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"files":{"type":"array","items":{"type":"object","required":["content"],"properties":{"content":{"type":"string","maxLength":4194304,"description":"File contents as text."},"filename":{"type":"string","maxLength":300,"description":"File name; the type is detected from content if absent."}},"additionalProperties":false},"maxItems":10,"minItems":1,"description":"The manifest or lock files."},"format":{"enum":["cyclonedx","spdx","plain"],"type":"string","default":"cyclonedx","description":"Output format."},"include_dev":{"type":"boolean","default":false,"description":"Include development-only dependencies."},"project_name":{"type":"string","default":"unnamed-project","maxLength":200,"description":"Name for the document metadata."}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_yTzzSTJFWQeHEWiF2fC7B","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Parses dependency files (package-lock.json, package.json, requirements.txt, go.mod, Cargo.lock) and generates a Software Bill of Materials in CycloneDX 1.5 or SPDX 2.3 format with package URLs per component.","exampleAgentPrompt":"Generate a CycloneDX 1.5 software bill of materials from my package-lock.json — I want a full pURL for every component so I know exactly which versions are actually installed, not just the ranges from my package.json.","exampleUseCases":[{"title":"npm lockfile SBOM for compliance audit","prompt":"I need to produce a CycloneDX 1.5 SBOM from our package-lock.json for our SOC 2 audit — generate the full bill of materials with a package URL for every installed package."},{"title":"Python project SPDX document","prompt":"Generate an SPDX 2.3 bill of materials from our requirements.txt — the security team needs a formal dependency inventory with pURLs for all our Python packages."},{"title":"Rust supply chain inventory","prompt":"Parse our Cargo.lock and give me a CycloneDX 1.5 SBOM — I want to see the exact versions of every crate we're shipping, not just the ranges we specified in Cargo.toml."}],"resultDescription":"A structured SBOM document in either CycloneDX 1.5 or SPDX 2.3 format listing all resolved components with their name, version, and package URL (purl). The document distinguishes between lockfile-derived (exact installed versions) and manifest-derived (version ranges) components.","failureModes":["Malformed or unparseable input file returns a parse error","Unsupported file format returns an unsupported manifest type error","Manifest-only input (e.g. package.json without lockfile) produces a BOM with version ranges rather than exact versions, which is noted explicitly","Missing or empty dependency sections result in an empty component list","Invalid SBOM format enum value returns a validation error"],"whenToPreferThis":"Choose this endpoint when you need a machine-readable, standards-compliant SBOM (CycloneDX 1.5 or SPDX 2.3) with package URLs from actual dependency files, especially when you need to distinguish exact installed versions (from lockfiles) from declared ranges (from manifests). Prefer this over generic dependency parsers when compliance output format matters, or when downstream tools (vulnerability scanners, license checkers) require pURL-tagged CycloneDX or SPDX documents.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-13T00:31:36.604Z","isFirstParty":false,"canonicalSlug":"sicher-sbom-generator-ce83f509"}