SBOM generators

Level 1 tools: they produce the inventory of an artefact. See Generate and steer for the distinction from platforms.

Caveat. These profiles describe categories of tool and their structural properties, not a snapshot of the market. Coverage, formats and performance change; any decision must rest on an evaluation run against your own artefacts.

Syft

Site	github.com/anchore/syft
Vendor	Anchore
Licence	Open (Apache 2.0)
Level	Generation
Formats	CycloneDX, SPDX, native format
Coverage	Very broad, multi-ecosystem: system packages, languages, container images, file systems
Vulnerabilities	No — that is Grype’s role
Licences	Declared metadata, no file-content analysis
Deployment	Standalone binary, self-hosted
Strengths	The de facto reference for generation; clean output; excellent CI integration; covers both file system and image
Limits	Does not detect licences by content analysis; imperfect coverage of natively compiled binaries
Verdict	Reference generator for most of your chains

Grype

Site	github.com/anchore/grype
Vendor	Anchore
Licence	Open
Level	Detection, downstream of generation
Input	An SBOM, an image, a directory
Sources	Aggregated public databases, distribution advisories
Strengths	Complements Syft; consumes an already-produced SBOM, avoiding a rescan; handles distribution backports
Limits	No reachability analysis
Verdict	Local check in CI, alongside the correlation performed by the platform

Trivy

Site	trivy.dev
Vendor	Aqua Security
Licence	Open
Level	Generation and detection
Scope	SBOM, vulnerabilities, secrets, infrastructure-as-code misconfigurations, declared licences
Formats	CycloneDX, SPDX
Strengths	All-in-one, very easy to integrate, one command covers several checks; own, frequently updated vulnerability database
Limits	All-in-one blurs responsibilities; for a mature arrangement, separating generation from detection makes replacing a link easier
Verdict	An excellent entry point and a good fit for simple chains; to reassess once the steering platform is in place

cdxgen

Site	github.com/cdxgen/cdxgen
Vendor	OWASP
Licence	Open
Level	Generation
Formats	Native CycloneDX, including extensions
Coverage	Very broad across languages, including ecosystems poorly covered elsewhere
Strengths	Configurable analysis depth; produces rich CycloneDX documents with relationships and build metadata
Limits	More demanding to configure; verbose output
Verdict	Worth keeping for ecosystems poorly covered by generic generators

osv-scanner

Site	google.github.io/osv-scanner
Vendor	Google
Licence	Open
Level	Detection
Source	The OSV database, purl correlation
Strengths	High matching precision thanks to per-ecosystem identifiers; sharply reduces false positives compared with CPE correlation
Limits	Coverage centred on package ecosystems; less relevant for exotic system binaries
Verdict	Use it alongside others, precisely for its low false-positive rate

ScanCode Toolkit and OSS Review Toolkit

Site	ScanCode · ORT
Vendor	Open source communities
Licence	Open
Level	Generation, licence-oriented
Method	Analysis of file content, not only of manifests
Strengths	Detect licences and copyrights in the code, including vendored or copied code — which generic generators do not see
Limits	Slow; verbose output requiring review effort
Verdict	Essential for the intellectual property strand; run at a reduced cadence rather than on every build

Native build-chain plugins

CycloneDX for Maven and Gradle, npm sbom, generators for .NET, Rust, Go, and their equivalents.

Strengths	See the real resolution graph, with the version arbitration actually applied; natively distinguish scopes — runtime, build, test
Limits	One plugin per ecosystem to maintain; blind outside their own scope
Verdict	Prefer as the primary source for languages with a dependency manager, complemented by a generic generator on the artefact

Recommended combination

Context	Primary	Cross-check	Licences
Java, .NET, Node, Python	Native plugin	Generic generator on the artefact	Content-analysis tool, at reduced cadence
Go, Rust	Generic generator on the binary	—	Same
C / C++	Generator on the binary + build system	File-system analysis	Same
Container image	Generator on the image	All-in-one scanner	Same
Firmware	Specialised tooling	SBOM requirement on the supplier	Same

The principle: one primary generator per family, pinned and documented, one cross-check, and a separate, less frequent licence analysis.