Loading the registry…
MCP server to perform a scan and produce an SBOM
We found this by crawling public sources and nobody has attested to it. That is how most of the registry gets here, and it is not a mark against the artifact — it only means no authenticated act of publication is on record. An artifact can be the vendor's own and still appear here.
Choose your runtime: the CLI writes the mcpServers config entry for that target.
nerlo install --target claude-code -- mcp-sbom
Install respects the composite badge: Clean proceeds, Caution prompts for confirmation, and Flagged is refused. Write operations require an API token.
Not yet scanned
This server is in the registry but has no completed scan yet. Per-scanner scoresheets appear here once the pipeline finishes its first run.