Sbomgate

pip install cognis-sbomgate

sbomgate scan .            # → prioritized findings in seconds

🔎 Example output

Real, reproducible output from the tool — runs offline:

$ sbomgate-emit --version
sbomgate 0.1.4

$ sbomgate-emit --help
usage: sbomgate [-h] [--version] <command> ...

Continuous SBOM diff & vulnerability watch with maintainer-change tracking.

positional arguments:
  <command>
    scan      diff two SBOMs and/or match vulnerabilities, then gate
    diff      diff two SBOMs (added/removed/version/maintainer)
    vulns     match one SBOM against a local advisory feed and/or the bundled
              DB
    db        query the bundled offline OSV vuln DB
              (count/cve/package/search/match)
    feeds     list/update/get the bundled CISA-KEV, EPSS and OSV feeds
              (edge/air-gap)

options:
  -h, --help  show this help message and exit
  --version   show program's version number and exit

Exit code 1 when the gate fails (a finding meets/exceeds --fail-on severity).

$ sbomgate-emit db
262351 vulnerabilities in the bundled offline DB

$ sbomgate-emit feeds
cisa-kev   vuln   [138.6h old]  CISA Known Exploited Vulnerabilities
             https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
  epss       vuln   [  uncached]  FIRST EPSS exploit-probability scores
             https://api.first.org/data/v1/epss
  osv        vuln   [  uncached]  OSV.dev vulnerability query
             https://api.osv.dev/v1/query

Blocks above are real sbomgate output — reproduce them from a clone.

Contents

• Why sbomgate? · Features · Quick start · Example · Demos · Architecture · AI stack · How it compares · Integrations · Install anywhere · Related · Contributing

Usage — step by step

sbomgate diffs two SBOMs and/or matches an SBOM against a local advisory feed, then gates. Exit code is 1 when a finding meets/exceeds --fail-on (default high).

1. Install

   pip install sbomgate
   

2. Scan the current SBOM against a previous one and a local advisory feed:

   sbomgate scan new-sbom.json --old old-sbom.json --advisories advisories.json
   

3. Run the focused subcommands — diff two SBOMs, vulns-match one, or match against the bundled offline DB (no feed needed):

   sbomgate diff old-sbom.json new-sbom.json
   sbomgate vulns new-sbom.json advisories.json
   sbomgate db match new-sbom.json            # offline 262k-record OSV match
   

4. Read JSON output and tune the gate with --fail-on {critical,high,medium,low}:

   sbomgate scan new-sbom.json --advisories advisories.json --format json | jq '.gate'
   

   Or emit SARIF 2.1.0 for GitHub code-scanning / SIEMs:

   sbomgate scan new-sbom.json --advisories advisories.json --format sarif > sbomgate.sarif
   

5. Use in CI — fail the build when a vuln or risky change crosses the threshold:

   sbomgate scan new-sbom.json --old old-sbom.json --advisories advisories.json \
     --fail-on high || exit 1
   

Why sbomgate?

Continuous SBOM diff & vulnerability watch with maintainer-change tracking — without standing up heavyweight infrastructure.

sbomgate is single-purpose, scriptable, and self-hostable: point it at a target, get prioritized results in the format your workflow already speaks (table · JSON · SARIF), gate CI on it, and let agents drive it over MCP.

Features

• ✅ Parse CycloneDX, SPDX, or native JSON SBOMs — auto-detected, no flags

• ✅ Diff two SBOMs — flags added / removed / version-change, and maintainer-change → high (supply-chain takeover signal)

• ✅ Match an advisory feed with real version-range semantics (<, <=, ==, >=, >, AND-ranges), ecosystem-scoped to kill false positives

• ✅ Bundled offline 262,351-record OSV vuln DB — sbomgate db match sbom.json resolves real CVEs (e.g. Log4Shell) with no feed and no network

• ✅ CI gate — exit code 1 when a finding meets/exceeds --fail-on (default high)

• ✅ Output formats: human table, machine json, and SARIF 2.1.0 for GitHub code-scanning / SIEMs

• ✅ Runs on Linux/macOS/Windows · Docker · devcontainer

• ✅ Ports in Python, JavaScript, Go, and Rust (ports/) — each mirrors the SBOM-diff + gate core, CI-built on every push

• ✅ Live threat-intel enrichment: CISA-KEV (known-exploited) + EPSS (exploit probability), edge/air-gap-ready

Threat-intel feeds — CISA-KEV + EPSS enrichment (edge / air-gap)

SBOMGATE ships a stdlib, keyless data-feed ingestion layer (sbomgate/datafeeds.py + the bundled data_feeds_2026.json catalog) and wires in the three feeds that genuinely sharpen an SBOM vulnerability gate:

feed	source	what it adds
cisa-kev	CISA Known Exploited Vulnerabilities	the authoritative list of CVEs observed actively exploited in the wild — a drop-everything signal
epss	FIRST EPSS	per-CVE probability of exploitation in the next 30 days (0..1) for risk-ranking
osv	OSV.dev	package@version → known vulns across PyPI/npm/Go/Maven/…

These are real public sources; no endpoints are invented. The feed layer is defensive / authorized-use only.

What the enrichment does

--enrich folds KEV + EPSS into the vulnerability findings: any finding whose advisory id resolves to a CVE on the CISA-KEV list is escalated to critical and tagged [KEV], and its EPSS score is attached ([KEV EPSS=0.9750]). A wall of undifferentiated "high" findings becomes a triage queue ordered by real-world exploitation likelihood.

# manage the feeds
sbomgate feeds list                       # show the 3 relevant feeds + cache age
sbomgate feeds update                      # fetch + cache cisa-kev, epss, osv
sbomgate feeds get cisa-kev --offline      # print the cached feed

# enrich a scan / vulns run
sbomgate vulns sbom.json advisories.json --enrich
sbomgate scan  new.json --advisories adv.json --enrich

Example (Log4Shell / Spring4Shell / Heartbleed are on CISA-KEV → escalated):

SEV  KIND           COMPONENT    DETAIL
!!   vulnerability  log4j-core   [CVE-2021-44228] [KEV EPSS=0.9750] Log4Shell: JNDI lookup RCE
!!   vulnerability  spring-core  [CVE-2022-22965] [KEV EPSS=0.9730] Spring4Shell RCE
!!   vulnerability  openssl      [CVE-2014-0160]  [KEV EPSS=0.9440] Heartbleed
!    vulnerability  requests     [GHSA-req-2015]  Credential leak (no CVE on KEV → stays high)

See demos/11-feeds-kev-epss-enrichment/ (run.sh is fully offline).

Edge / air-gap (offline + snapshot)

The feed cache lives at $COGNIS_FEEDS_CACHE (default ~/.cache/cognis-feeds). --offline serves only the cache and never touches the network — so the gate keeps working on disconnected / military / edge gear:

sbomgate vulns sbom.json adv.json --enrich --offline

Sneakernet the feeds into a disconnected enclave:

# connected side — refresh + pack the cache
sbomgate feeds update
python -m sbomgate.datafeeds snapshot-export feeds.tar.gz

#   …carry feeds.tar.gz across the air gap…

# enclave side — rehydrate the cache, then run offline forever
python -m sbomgate.datafeeds snapshot-import feeds.tar.gz
sbomgate vulns sbom.json adv.json --enrich --offline

Quick start

pip install cognis-sbomgate

sbomgate --version

sbomgate scan .                       # scan current project

sbomgate scan . --format json         # machine-readable

sbomgate scan . --format sarif        # SARIF 2.1.0 for code-scanning

sbomgate scan . --fail-on high        # CI gate (non-zero exit)

Example

A real run of the bundled 01-basic demo — a CI build that downgrades requests, re-introduces a critical, and shows a maintainer takeover:

$ sbomgate scan demos/01-basic/sbom-new.json \
      --old demos/01-basic/sbom-old.json \
      --advisories demos/01-basic/advisories.json

SBOM diff: 4 -> 4 components
  added=1  maintainer-change=1  removed=1  version-change=2

SEV  KIND              COMPONENT      DETAIL
---- ----------------- -------------  ------------------------------
!!   vulnerability     shady-logger   [GHSA-shady-0001] Remote code execution via log format string injection
!    maintainer-change leftpad-utils  maintainer of leftpad-utils changed (possible takeover)
!    vulnerability     requests       [GHSA-req-2015] Credential leak on cross-origin redirect in old requests releases
.    added             shady-logger   new dependency shady-logger 0.0.7
.    version-change    requests       requests 2.32.0 -> 2.5.0
.    version-change    urllib3        urllib3 2.2.1 -> 2.2.2
     removed           colorama       dependency colorama 0.4.6 removed

GATE: FAIL  (7 finding(s))
$ echo $?
1

Or match a Maven SBOM straight against the bundled offline DB — no advisory feed, no network:

$ sbomgate db match my-sbom.json       # my-sbom.json lists log4j-core 2.14.1
SEV  KIND              COMPONENT   DETAIL
---- ----------------- ----------  ------------------------------
!!   vulnerability     log4j-core  [CVE-2017-5645]  Deserialization of Untrusted Data in Log4j
!!   vulnerability     log4j-core  [CVE-2021-44228] Remote code injection in Log4j
!!   vulnerability     log4j-core  [CVE-2021-44832] Improper Input Validation and Injection in Apache Log4j2
!!   vulnerability     log4j-core  [CVE-2021-45046] Incomplete fix for Apache Log4j vulnerability
~    vulnerability     log4j-core  [CVE-2020-9488]  Improper validation of certificate with host mismatch ...
...
GATE: FAIL  (11 finding(s))

Demos — real-use-case scenarios

Every demo under demos/ ships a SCENARIO.md plus SBOM/advisory fixtures in sbomgate's real input format, and each one is exercised by the test suite so the documented outcome stays true.

Demo	What it shows	Outcome
01-basic	CI build between two CycloneDX SBOMs: downgrade + maintainer takeover + new critical dep	gate FAILs
04-spdx-format-nodejs	SPDX 2.3 input from a Node.js build (lodash, minimist)	gate FAILs
05-transitive-critical	A downgrade re-introduces a fixed critical (PyYAML CVE-2020-14343)	gate FAILs
06-clean-build-passes	Routine patch bumps, everything past its fix — the negative control	gate PASSes (exit 0)
07-ecosystem-mismatch	Same name on PyPI and npm — ecosystem-scoped, no false positive	gate FAILs (1)
08-multi-ecosystem-monorepo	PyPI + npm + Maven + Go, Text4Shell + axios SSRF + maintainer change	gate FAILs
09-sarif-codescanning	SARIF 2.1.0 export wired into GitHub code-scanning	gate FAILs
10-version-range-and-gate	== / >= / < / AND-range operator semantics + --fail-on tuning	gate FAILs

# try one end to end:
python -m sbomgate scan demos/05-transitive-critical/sbom-new.json \
    --old demos/05-transitive-critical/sbom-old.json \
    --advisories demos/05-transitive-critical/advisories.json

All CVE/GHSA identifiers in the demos are real, published advisories (except 10-version-range-and-gate, which uses clearly-labelled synthetic ids to document matcher semantics).

Architecture

flowchart LR
  IN[target / manifest] --> P[sbomgate<br/>checks + rules]
  P --> OUT[findings (JSON / SARIF)]

Use it from any AI stack

sbomgate is interoperable with every popular way of using AI:

• MCP server — sbomgate mcp (Claude Desktop, Cursor, Cognis.Studio, uncensored-fleet)

• OpenAI-compatible / JSON — pipe sbomgate scan . --format json into any agent or LLM

• LangChain · CrewAI · AutoGen · LlamaIndex — wrap the CLI/JSON as a tool in one line

• CI / scripts — exit codes + SARIF for non-AI pipelines

How it compares

| | Cognis sbomgate | anchore |

|---|:---:|:---:|

| Self-hostable, no account | ✅ | varies |

| Single command, zero config | ✅ | ⚠️ |

| JSON + SARIF for CI | ✅ | varies |

| MCP-native (AI agents) | ✅ | ❌ |

| Polyglot ports (JS/Go/Rust) | ✅ | ❌ |

| Open license | ✅ COCL | varies |

Built in the spirit of anchore/syft, re-framed the Cognis way. Missing a credit? Open a PR.

Integrations

Pipes into your stack: SARIF for code-scanning, JSON for anything, an MCP server (sbomgate mcp) for AI agents, and a webhook forwarder for SIEM/Slack/Jira. See docs/INTEGRATIONS.md.

Install — every way, every platform

pip install "git+https://github.com/cognis-digital/sbomgate.git"    # pip (works today)

pipx install "git+https://github.com/cognis-digital/sbomgate.git"   # isolated CLI

uv tool install "git+https://github.com/cognis-digital/sbomgate.git" # uv

pip install cognis-sbomgate                                          # PyPI (when published)

docker run --rm ghcr.io/cognis-digital/sbomgate:latest --help        # Docker

brew install cognis-digital/tap/sbomgate                             # Homebrew tap

curl -fsSL https://raw.githubusercontent.com/cognis-digital/sbomgate/main/install.sh | sh

| Linux | macOS | Windows | Docker | Cloud |

|---|---|---|---|---|

| scripts/setup-linux.sh | scripts/setup-macos.sh | scripts/setup-windows.ps1 | docker run ghcr.io/cognis-digital/sbomgate | DEPLOY.md (AWS/Azure/GCP/k8s) |

Related Cognis tools

• sentrylog — Single-file SIEM for small teams — Sigma rules + multi-source ingest

• edrgap — EDR coverage & bypass detector — reconciles MDM + EDR + AD inventories

• canarynet — Self-hosted canary token network — AWS keys, DNS, docs, web URLs

• phishforge — Open-source phishing simulation — campaigns, templates, training

• honeytrace — Active-decoy network lure system — SSH, RDP, SMB, web honeypots

Explore the suite → 🗂️ all 170+ tools · ⭐ awesome-cognis · 🔗 cognis-sources · 🤖 uncensored-fleet · 🧠 engram

Contributing

PRs, new rules, and demo scenarios are welcome under the collaboration-pull model — see CONTRIBUTING.md and SECURITY.md.

⭐ If sbomgate saved you time, star it — it genuinely helps others find it.

Interoperability

{} composes with the 300+ tool Cognis suite — JSON in/out and a shared OpenAI-compatible /v1 backbone. See INTEROP.md for the suite map, composition patterns, and reference stacks.

License

Source-available under the Cognis Open Collaboration License (COCL) v1.0 — free for personal, internal-evaluation, research, and educational use; commercial / production use requires a license ([email protected]). See LICENSE.

---

Bundled offline vulnerability database

sbomgate ships sbomgate/cognis_vulndb.jsonl.gz — 262,351 real vulnerabilities sourced from OSV.dev across PyPI / npm / Go / Maven / RubyGems / crates.io / NuGet, with full metadata per record (CVE/GHSA aliases, ecosystem, CVSS severity, affected packages, published/modified dates). It is a pure-stdlib gzip; the loader (sbomgate/vulndb_local.py) opens it lazily and indexes by CVE and by package — no network, no API key, no service to stand up.

The DB is wired straight into the CLI via the db subcommand and the --match-db flag, so the gate works the moment you clone the repo:

sbomgate db count                          # 262351 vulnerabilities in the bundled offline DB
sbomgate db cve CVE-2021-44228             # full record(s) for Log4Shell (GHSA-jfh8-c2jp-5v3q)
sbomgate db package log4j-core             # every advisory affecting log4j-core
sbomgate db search "deserialization"       # substring search over summaries
sbomgate db match my-sbom.json             # match a whole SBOM, gate on the result (offline)

# fold the offline DB into a normal scan / vulns run:
sbomgate scan  new.json --old old.json --match-db
sbomgate vulns my-sbom.json --match-db     # no advisory feed required

Matching is ecosystem-scoped and resolves short artifact names against full coordinates — so an SBOM component named log4j-core correctly matches the OSV record for org.apache.logging.log4j:log4j-core. Combine --match-db with --enrich --offline to also tag the cached CISA-KEV / EPSS signal.

Refreshing the corpus on the edge (NVD / OSV / GHSA)

The bundled DB is the offline baseline. To extend it on a connected box and sneakernet the result into an air-gapped enclave, use the keyless harvester in sbomgate/datafeeds.py (every endpoint comes from the verified, keyless data_feeds_2026.json catalog):

# connected side — paginate NVD 2.0 (or GitHub GHSA) into the feed cache
python -m sbomgate.datafeeds bulk nvd-cve --max 50000
python -m sbomgate.datafeeds snapshot-export feeds.tar.gz

#   …carry feeds.tar.gz across the air gap…

# enclave side — rehydrate, then run the gate offline forever
python -m sbomgate.datafeeds snapshot-import feeds.tar.gz
sbomgate vulns my-sbom.json --match-db --enrich --offline

Everything here is passive and offline — sbomgate reads files and a local gzip; it never scans a host or opens a socket against a target. See the Scope & safety note below.

Scope, authorization & safety

sbomgate is a defensive, passive, authorized-use tool. It parses SBOM/advisory JSON you already have and matches it against a local database. It performs no active scanning — no host probing, no exploitation, no network reconnaissance — and the threat-intel feed layer only ever fetches from public, keyless, read-only data sources (or serves from cache with --offline). All CVE/GHSA identifiers in the bundled DB and demos are real, published advisories (the sole exception is demos/10-version-range-and-gate, whose ids are clearly labelled synthetic to document matcher semantics). Use it only on SBOMs and systems you are authorized to assess.