Endor Labs SBOM Management
Manage Software Bill of Materials - export, import, analyze, and compare.
Supported Actions
| Action |
Description |
export |
Generate SBOM from current project |
import |
Import and analyze an external SBOM |
analyze |
Analyze project's component inventory |
compare |
Compare two SBOMs for drift detection |
validate |
Check SBOM format compliance |
Workflow
Action: Export
- Use
get_resource MCP tool (resource_type: Project, name: project/repo name) to get UUID. If not found, suggest /endor-scan first.
- Export SBOM:
# CycloneDX (recommended)
npx -y endorctl sbom export --project-uuid {uuid} --format cyclonedx --output sbom-cyclonedx.json
# SPDX
npx -y endorctl sbom export --project-uuid {uuid} --format spdx --output sbom-spdx.json
- Present summary with: format, file path, project name, component counts by type (Libraries/Frameworks/Applications/Total), top-level dependencies with versions and licenses, NTIA compliance checks (component names, versions, unique IDs, dependency relationships, author info, timestamp).
Action: Analyze
- Run
/endor-scan if not already scanned
- Query findings and dependencies
- Present component breakdown:
- Counts by category (direct/transitive/dev) with vuln and license risk counts
- Vulnerability coverage: components with CVEs, critical/high count, reachable count
- License distribution with risk levels
Action: Compare
Compare two SBOMs for drift detection. Present:
- Added/removed/updated packages with versions
- Security impact: new vulns introduced, vulns resolved, net change
- License impact: new risks, resolved risks
Action: Validate
Validate SBOM file against compliance standards. Check: format validity, NTIA minimum elements, component completeness, dependency relationships.
Next Steps
/endor-scan - scan for vulnerabilities/endor-license - check license compliance/endor-cicd - automate SBOM generation
For data source policy, read references/data-sources.md.
Error Handling
| Error |
Action |
| Project not found |
Run /endor-scan first |
| Auth error |
Run /endor-setup |
| Invalid SBOM format |
Show validation errors, suggest corrections |
1---2name: endor-sbom3description: Manage Software Bill of Materials — export, import, analyze, and compare SBOMs in CycloneDX and SPDX formats. Use when the user says "generate SBOM", "export SBOM", "software bill of materials", "endor sbom", "compare SBOMs", "NTIA compliance", or needs component inventory for compliance. Do NOT use for vulnerability scanning (/endor-scan) or license analysis (/endor-license).4---56# Endor Labs SBOM Management78Manage Software Bill of Materials - export, import, analyze, and compare.910## Supported Actions1112| Action | Description |13|--------|-------------|14| `export` | Generate SBOM from current project |15| `import` | Import and analyze an external SBOM |16| `analyze` | Analyze project's component inventory |17| `compare` | Compare two SBOMs for drift detection |18| `validate` | Check SBOM format compliance |1920## Workflow2122### Action: Export23241. Use `get_resource` MCP tool (`resource_type`: `Project`, `name`: project/repo name) to get UUID. If not found, suggest `/endor-scan` first.252. Export SBOM:26```bash27# CycloneDX (recommended)28npx -y endorctl sbom export --project-uuid {uuid} --format cyclonedx --output sbom-cyclonedx.json2930# SPDX31npx -y endorctl sbom export --project-uuid {uuid} --format spdx --output sbom-spdx.json32```333. Present summary with: format, file path, project name, component counts by type (Libraries/Frameworks/Applications/Total), top-level dependencies with versions and licenses, NTIA compliance checks (component names, versions, unique IDs, dependency relationships, author info, timestamp).3435### Action: Analyze36371. Run `/endor-scan` if not already scanned382. Query findings and dependencies393. Present component breakdown:40 - Counts by category (direct/transitive/dev) with vuln and license risk counts41 - Vulnerability coverage: components with CVEs, critical/high count, reachable count42 - License distribution with risk levels4344### Action: Compare4546Compare two SBOMs for drift detection. Present:47- Added/removed/updated packages with versions48- Security impact: new vulns introduced, vulns resolved, net change49- License impact: new risks, resolved risks5051### Action: Validate5253Validate SBOM file against compliance standards. Check: format validity, NTIA minimum elements, component completeness, dependency relationships.5455## Next Steps56571. `/endor-scan` - scan for vulnerabilities582. `/endor-license` - check license compliance593. `/endor-cicd` - automate SBOM generation6061For data source policy, read references/data-sources.md.6263## Error Handling6465| Error | Action |66|-------|--------|67| Project not found | Run `/endor-scan` first |68| Auth error | Run `/endor-setup` |69| Invalid SBOM format | Show validation errors, suggest corrections |
endorlabs