# 932 Sbom 60983dee > > **Note:** This document is auto-generated from the project's Software Bill of Materials (SBOM). Fields showing "NOT DEFINED" or "NOT KNOWN" indicate metadata not provided by the upstream package. The "PDM outdated check" status reflects the CI pipeline state at generation time. - Skill: `tools-only/932-sbom-60983dee` (Agent Skill, multi-file: 3 files) - Install (CLI): `npx skillmds@latest add tools-only/932-sbom-60983dee` - Raw SKILL.md: https://api.skillmd.com/api/skills/tools-only/932-sbom-60983dee/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: tools-only (https://skillmd.com/u/tools-only) - Updated: 2026-09-22 - Page: https://skillmd.com/skills/tools-only/932-sbom-60983dee --- > **Note:** This document is auto-generated from the project's Software Bill of Materials (SBOM). Fields showing "NOT DEFINED" or "NOT KNOWN" indicate metadata not provided by the upstream package. The "PDM outdated check" status reflects the CI pipeline state at generation time. # SBOM Summary Item | Details | -------- | -------- SBOM File | mcpgateway.sbom.xml SBOM Type | cyclonedx Version | 1.6 Name | NOT DEFINED Created | 2026-02-01T07:26:02.035360+00:00 Files | 0 Packages | 85 Relationships | 195 Services | 0 Vulnerabilities | 0 # Package Summary Name | Version | PURL | CPE | Type | Supplier | License | Ecosystem | Download | Copyright | -------- | -------- | -------- | -------- | -------- | -------- | -------- | -------- | -------- | -------- Jinja2 | 3.1.6 | pkg:pypi/jinja2@3.1.6 | | LIBRARY | | License :: OSI Approved :: BSD License | pypi | NOT KNOWN | A very fast and expressive template engine. Mako | 1.3.10 | pkg:pypi/mako@1.3.10 | | LIBRARY | | MIT | pypi | NOT KNOWN | A super-fast templating language that borrows the best ideas from the existing templating languages. MarkupSafe | 3.0.3 | pkg:pypi/markupsafe@3.0.3 | | LIBRARY | | BSD-3-Clause | pypi | NOT KNOWN | Safely add untrusted strings to HTML/XML markup. PyJWT | 2.11.0 | pkg:pypi/pyjwt@2.11.0 | | LIBRARY | | MIT | pypi | NOT KNOWN | JSON Web Token implementation in Python PyYAML | 6.0.3 | pkg:pypi/pyyaml@6.0.3 | | LIBRARY | | MIT | pypi | https://pypi.org/project/PyYAML/ | YAML parser and emitter for Python Pygments | 2.19.2 | pkg:pypi/pygments@2.19.2 | | LIBRARY | | License :: OSI Approved :: BSD License | pypi | NOT KNOWN | Pygments is a syntax highlighting package written in Python. SQLAlchemy | 2.0.46 | pkg:pypi/sqlalchemy@2.0.46 | | LIBRARY | | MIT | pypi | NOT KNOWN | Database Abstraction Library aiohappyeyeballs | 2.6.1 | pkg:pypi/aiohappyeyeballs@2.6.1 | | LIBRARY | | Python-2.0 | pypi | NOT KNOWN | Happy Eyeballs for asyncio aiohttp | 3.13.3 | pkg:pypi/aiohttp@3.13.3 | | LIBRARY | | NOT KNOWN | pypi | NOT KNOWN | Async http client/server framework (asyncio) aiosignal | 1.4.0 | pkg:pypi/aiosignal@1.4.0 | | LIBRARY | | License :: OSI Approved :: Apache Software License | pypi | NOT KNOWN | aiosignal: a list of registered asynchronous callbacks alembic | 1.18.3 | pkg:pypi/alembic@1.18.3 | | LIBRARY | | MIT | pypi | NOT KNOWN | A database migration tool for SQLAlchemy. annotated-doc | 0.0.4 | pkg:pypi/annotated-doc@0.0.4 | | LIBRARY | | MIT | pypi | NOT KNOWN | Document parameters, class attributes, return types, and variables inline, with Annotated. annotated-types | 0.7.0 | pkg:pypi/annotated-types@0.7.0 | | LIBRARY | | MIT | pypi | NOT KNOWN | Reusable constraint types to use with typing.Annotated anyio | 4.12.1 | pkg:pypi/anyio@4.12.1 | | LIBRARY | | MIT | pypi | NOT KNOWN | High-level concurrency and networking framework on top of asyncio or Trio argon2-cffi | 25.1.0 | pkg:pypi/argon2-cffi@25.1.0 | | LIBRARY | | MIT | pypi | NOT KNOWN | Argon2 for Python argon2-cffi-bindings | 25.1.0 | pkg:pypi/argon2-cffi-bindings@25.1.0 | | LIBRARY | | MIT | pypi | NOT KNOWN | Low-level CFFI bindings for Argon2 attrs | 25.4.0 | pkg:pypi/attrs@25.4.0 | | LIBRARY | | MIT | pypi | NOT KNOWN | Classes Without Boilerplate brotli | 1.2.0 | pkg:pypi/brotli@1.2.0 | | LIBRARY | | MIT | pypi | NOT KNOWN | Python bindings for the Brotli compression library certifi | 2026.1.4 | pkg:pypi/certifi@2026.1.4 | | LIBRARY | | License :: OSI Approved :: Mozilla Public License 2.0 (MPL 2.0) | pypi | NOT KNOWN | Python package for providing Mozilla's CA Bundle. cffi | 2.0.0 | pkg:pypi/cffi@2.0.0 | | LIBRARY | | MIT | pypi | NOT KNOWN | Foreign Function Interface for Python calling C code. charset-normalizer | 3.4.4 | pkg:pypi/charset-normalizer@3.4.4 | | LIBRARY | | MIT | pypi | NOT KNOWN | The Real First Universal Charset Detector. Open, modern and actively maintained alternative to Chardet. click | 8.3.1 | pkg:pypi/click@8.3.1 | | LIBRARY | | BSD-3-Clause | pypi | NOT KNOWN | Composable command line interface toolkit cryptography | 46.0.4 | pkg:pypi/cryptography@46.0.4 | | LIBRARY | | NOT KNOWN | pypi | NOT KNOWN | cryptography is a package which provides cryptographic recipes and primitives to Python developers. dnspython | 2.8.0 | pkg:pypi/dnspython@2.8.0 | | LIBRARY | | ISC | pypi | NOT KNOWN | DNS toolkit email-validator | 2.3.0 | pkg:pypi/email-validator@2.3.0 | | LIBRARY | | Unlicense | pypi | NOT KNOWN | A robust email address syntax and deliverability validation library. fastapi | 0.128.0 | pkg:pypi/fastapi@0.128.0 | | LIBRARY | | MIT | pypi | NOT KNOWN | FastAPI framework, high performance, easy to learn, fast to code, ready for production filelock | 3.20.3 | pkg:pypi/filelock@3.20.3 | | LIBRARY | | Unlicense | pypi | NOT KNOWN | A platform independent file lock. frozenlist | 1.8.0 | pkg:pypi/frozenlist@1.8.0 | | LIBRARY | | Apache-2.0 | pypi | NOT KNOWN | A list-like structure which implements collections.abc.MutableSequence greenlet | 3.3.1 | pkg:pypi/greenlet@3.3.1 | | LIBRARY | | NOT KNOWN | pypi | NOT KNOWN | Lightweight in-process concurrent programming gunicorn | 24.1.1 | pkg:pypi/gunicorn@24.1.1 | | LIBRARY | | MIT | pypi | NOT KNOWN | WSGI HTTP Server for UNIX h11 | 0.16.0 | pkg:pypi/h11@0.16.0 | | LIBRARY | | MIT | pypi | NOT KNOWN | A pure-Python, bring-your-own-I/O implementation of HTTP/1.1 h2 | 4.3.0 | pkg:pypi/h2@4.3.0 | | LIBRARY | | MIT | pypi | NOT KNOWN | Pure-Python HTTP/2 protocol implementation hpack | 4.1.0 | pkg:pypi/hpack@4.1.0 | | LIBRARY | | MIT | pypi | NOT KNOWN | Pure-Python HPACK header encoding httpcore | 1.0.9 | pkg:pypi/httpcore@1.0.9 | | LIBRARY | | BSD-3-Clause | pypi | NOT KNOWN | A minimal low-level HTTP client. httptools | 0.7.1 | pkg:pypi/httptools@0.7.1 | | LIBRARY | | MIT | pypi | NOT KNOWN | A collection of framework independent HTTP protocol utils. httpx | 0.28.1 | pkg:pypi/httpx@0.28.1 | | LIBRARY | | License :: OSI Approved :: BSD License | pypi | NOT KNOWN | The next generation HTTP client. httpx-sse | 0.4.3 | pkg:pypi/httpx-sse@0.4.3 | | LIBRARY | | MIT | pypi | NOT KNOWN | Consume Server-Sent Event (SSE) messages with HTTPX. hyperframe | 6.1.0 | pkg:pypi/hyperframe@6.1.0 | | LIBRARY | | MIT | pypi | NOT KNOWN | Pure-Python HTTP/2 framing idna | 3.11 | pkg:pypi/idna@3.11 | | LIBRARY | | BSD-3-Clause | pypi | NOT KNOWN | Internationalized Domain Names in Applications (IDNA) ifaddr | 0.2.0 | pkg:pypi/ifaddr@0.2.0 | | LIBRARY | | MIT | pypi | NOT KNOWN | Cross-platform network interface and IP address enumeration library jq | 1.11.0 | pkg:pypi/jq@1.11.0 | | LIBRARY | | BSD-2-Clause | pypi | NOT KNOWN | jq is a lightweight and flexible JSON processor. jsonpath-ng | 1.7.0 | pkg:pypi/jsonpath-ng@1.7.0 | | LIBRARY | | License :: OSI Approved :: Apache Software License | pypi | NOT KNOWN | A final implementation of JSONPath for Python that aims to be standard compliant, including arithmetic and binary comparison operators and providing clear AST for metaprogramming. jsonschema | 4.26.0 | pkg:pypi/jsonschema@4.26.0 | | LIBRARY | | MIT | pypi | NOT KNOWN | An implementation of JSON Schema validation for Python jsonschema-specifications | 2025.9.1 | pkg:pypi/jsonschema-specifications@2025.9.1 | | LIBRARY | | MIT | pypi | NOT KNOWN | The JSON Schema meta-schemas and vocabularies, exposed as a Registry markdown-it-py | 4.0.0 | pkg:pypi/markdown-it-py@4.0.0 | | LIBRARY | | MIT | pypi | NOT KNOWN | Python port of markdown-it. Markdown parsing, done right! mcp | 1.26.0 | pkg:pypi/mcp@1.26.0 | | LIBRARY | | MIT | pypi | NOT KNOWN | Model Context Protocol SDK mcp-contextforge-gateway | 1.0.0b2 | | | LIBRARY | | Apache-2.0 | - | NOT KNOWN | A production-grade MCP Gateway & Proxy built with FastAPI. Supports multi-server registration, virtual server composition, authentication, retry logic, observability, protocol translation, and a unified federated tool catalog. mdurl | 0.1.2 | pkg:pypi/mdurl@0.1.2 | | LIBRARY | | MIT | pypi | NOT KNOWN | Markdown URL utilities multidict | 6.7.1 | pkg:pypi/multidict@6.7.1 | | LIBRARY | | NOT KNOWN | pypi | NOT KNOWN | multidict implementation oauthlib | 3.3.1 | pkg:pypi/oauthlib@3.3.1 | | LIBRARY | | BSD-3-Clause | pypi | NOT KNOWN | A generic, spec-compliant, thorough implementation of the OAuth request-signing logic orjson | 3.11.6 | pkg:pypi/orjson@3.11.6 | | LIBRARY | | NOT KNOWN | pypi | NOT KNOWN | Fast, correct Python JSON library supporting dataclasses, datetimes, and numpy packaging | 26.0 | pkg:pypi/packaging@26.0 | | LIBRARY | | NOT KNOWN | pypi | NOT KNOWN | Core utilities for Python packages parse | 1.20.2 | pkg:pypi/parse@1.20.2 | | LIBRARY | | MIT | pypi | NOT KNOWN | parse() is the opposite of format() ply | 3.11 | pkg:pypi/ply@3.11 | | LIBRARY | | NOT KNOWN | pypi | NOT KNOWN | Python Lex & Yacc prometheus-fastapi-instrumentator | 7.1.0 | pkg:pypi/prometheus-fastapi-instrumentator@7.1.0 | | LIBRARY | | License :: OSI Approved | pypi | NOT KNOWN | Instrument your FastAPI app with Prometheus metrics prometheus_client | 0.24.1 | pkg:pypi/prometheus-client@0.24.1 | | LIBRARY | | NOT KNOWN | pypi | NOT KNOWN | Python client for the Prometheus monitoring system. propcache | 0.4.1 | pkg:pypi/propcache@0.4.1 | | LIBRARY | | License :: OSI Approved :: Apache Software License | pypi | NOT KNOWN | Accelerated property cache psutil | 7.2.2 | pkg:pypi/psutil@7.2.2 | | LIBRARY | | BSD-3-Clause | pypi | NOT KNOWN | Cross-platform lib for process and system monitoring. pycparser | 3.0 | pkg:pypi/pycparser@3.0 | | LIBRARY | | BSD-3-Clause | pypi | NOT KNOWN | C parser in Python pydantic | 2.12.5 | pkg:pypi/pydantic@2.12.5 | | LIBRARY | | MIT | pypi | NOT KNOWN | Data validation using Python type hints pydantic-settings | 2.12.0 | pkg:pypi/pydantic-settings@2.12.0 | | LIBRARY | | MIT | pypi | NOT KNOWN | Settings management using Pydantic pydantic_core | 2.41.5 | pkg:pypi/pydantic-core@2.41.5 | | LIBRARY | | MIT | pypi | NOT KNOWN | Core functionality for Pydantic validation and serialization python-dotenv | 1.2.1 | pkg:pypi/python-dotenv@1.2.1 | | LIBRARY | | BSD-3-Clause | pypi | NOT KNOWN | Read key-value pairs from a .env file and set them as environment variables python-json-logger | 4.0.0 | pkg:pypi/python-json-logger@4.0.0 | | LIBRARY | | License :: OSI Approved :: BSD License | pypi | NOT KNOWN | JSON Log Formatter for the Python Logging Package python-multipart | 0.0.22 | pkg:pypi/python-multipart@0.0.22 | | LIBRARY | | Apache-2.0 | pypi | NOT KNOWN | A streaming multipart parser for Python referencing | 0.37.0 | pkg:pypi/referencing@0.37.0 | | LIBRARY | | MIT | pypi | NOT KNOWN | JSON Referencing + Python requests | 2.32.5 | pkg:pypi/requests@2.32.5 | | LIBRARY | | License :: OSI Approved :: Apache Software License | pypi | NOT KNOWN | Python HTTP for Humans. requests-oauthlib | 2.0.0 | pkg:pypi/requests-oauthlib@2.0.0 | | LIBRARY | | License :: OSI Approved :: BSD License | pypi | NOT KNOWN | OAuthlib authentication support for Requests. rich | 14.3.1 | pkg:pypi/rich@14.3.1 | | LIBRARY | | MIT | pypi | NOT KNOWN | Render rich text, tables, progress bars, syntax highlighting, markdown and more to the terminal rpds-py | 0.30.0 | pkg:pypi/rpds-py@0.30.0 | | LIBRARY | | MIT | pypi | NOT KNOWN | Python bindings to Rust's persistent data structures (rpds) shellingham | 1.5.4 | pkg:pypi/shellingham@1.5.4 | | LIBRARY | | ISC | pypi | NOT KNOWN | Tool to Detect Surrounding Shell sse-starlette | 3.2.0 | pkg:pypi/sse-starlette@3.2.0 | | LIBRARY | | BSD-3-Clause | pypi | NOT KNOWN | SSE plugin for Starlette starlette | 0.50.0 | pkg:pypi/starlette@0.50.0 | | LIBRARY | | BSD-3-Clause | pypi | NOT KNOWN | The little ASGI library that shines. starlette-compress | 1.7.0 | pkg:pypi/starlette-compress@1.7.0 | | LIBRARY | | 0BSD | pypi | NOT KNOWN | Compression middleware for Starlette - supporting ZStd, Brotli, and GZip typer | 0.21.1 | pkg:pypi/typer@0.21.1 | | LIBRARY | | MIT | pypi | NOT KNOWN | Typer, build great CLIs. Easy to code. Based on Python type hints. typing-inspection | 0.4.2 | pkg:pypi/typing-inspection@0.4.2 | | LIBRARY | | MIT | pypi | NOT KNOWN | Runtime typing introspection tools typing_extensions | 4.15.0 | pkg:pypi/typing-extensions@4.15.0 | | LIBRARY | | PSF-2.0 | pypi | NOT KNOWN | Backported and Experimental Type Hints for Python 3.9+ urllib3 | 2.6.3 | pkg:pypi/urllib3@2.6.3 | | LIBRARY | | MIT | pypi | NOT KNOWN | HTTP library with thread-safe connection pooling, file post, and more. uvicorn | 0.40.0 | pkg:pypi/uvicorn@0.40.0 | | LIBRARY | | BSD-3-Clause | pypi | NOT KNOWN | The lightning-fast ASGI server. uvloop | 0.22.1 | pkg:pypi/uvloop@0.22.1 | | LIBRARY | | License :: OSI Approved :: Apache Software License | pypi | NOT KNOWN | Fast implementation of asyncio event loop on top of libuv watchfiles | 1.1.1 | pkg:pypi/watchfiles@1.1.1 | | LIBRARY | | MIT | pypi | NOT KNOWN | Simple, modern and high performance file watching and code reload in python. websockets | 16.0 | pkg:pypi/websockets@16.0 | | LIBRARY | | BSD-3-Clause | pypi | NOT KNOWN | An implementation of the WebSocket Protocol (RFC 6455 & 7692) yarl | 1.22.0 | pkg:pypi/yarl@1.22.0 | | LIBRARY | | License :: OSI Approved :: Apache Software License | pypi | NOT KNOWN | Yet another URL library zeroconf | 0.148.0 | pkg:pypi/zeroconf@0.148.0 | | LIBRARY | | LGPL-2.1-or-later | pypi | NOT KNOWN | A pure python implementation of multicast DNS service discovery zstandard | 0.25.0 | pkg:pypi/zstandard@0.25.0 | | LIBRARY | | BSD-3-Clause | pypi | NOT KNOWN | Zstandard bindings for Python # Component Type Summary Type | Count | -------- | -------- LIBRARY | 85 # License Summary License | Count | -------- | -------- 0BSD | 1 Apache-2.0 | 3 BSD-2-Clause | 1 BSD-3-Clause | 13 ISC | 2 LGPL-2.1-or-later | 1 License :: OSI Approved | 1 License :: OSI Approved :: Apache Software License | 6 License :: OSI Approved :: BSD License | 5 License :: OSI Approved :: Mozilla Public License 2.0 (MPL 2.0) | 1 MIT | 39 NOT KNOWN | 8 PSF-2.0 | 1 Python-2.0 | 1 Unlicense | 2 # NTIA Summary Element | Status | -------- | -------- All file information provided? | True All package information provided? | False Creator identified? | False Creation time identified? | True Dependency relationships provided? | True NTIA conformant False ## Trivy Vulnerability Scan ## Outdated Packages PDM outdated check failed