MCP SBOM Server

Performs a Trivy scan and produces a CycloneDX SBOM for MCP workflows.

javascript

0

GitHub Stars

javascript

Language

4 months ago

First Indexed

2 months ago

Catalog Refreshed

Documentation & install

Readme and setup notes from the catalogue, plus a client-ready config you can copy for your MCP host.

Installation

Add the following to your MCP client configuration file.

Configuration

View docs

{
  "mcpServers": {
    "mcp-mirror-gkhays_mcp-sbom-server": {
      "command": "uv",
      "args": [
        "--directory",
        "/path/to/mcp-sbom",
        "run",
        "mcp-sbom"
      ]
    }
  }
}

The MCP SBOM Server automates a Trivy security scan and outputs a CycloneDX SBOM, helping you assess component risk and maintain visibility into your software supply chain. You can run it locally from your development environment or integrate it into your MCP workflow to generate SBOM data on demand.

How to use

To use this server, configure your MCP client to start the local SBOM service with the uv runner, then trigger scans through your MCP workflow. The server will perform a Trivy scan and emit an SBOM in CycloneDX format, enabling you to analyze dependencies and security findings alongside your existing MCP data.

How to install

Prerequisites you need to have installed before running the server.

Install the following tools before setting up the MCP SBOM Server.

# Prerequisites
# Install uv (the microservice orchestrator) if not already installed
# Install Trivy for SBOM scanning
# Install Node.js (runtime for MCP tooling)

# Note: Use your platform-specific install commands for uv, trivy, and Node.js.

MCP Clients

Configure an MCP client to launch the SBOM server using the local runtime. The example below shows how to wire uv to run the SBOM service from a local path.

"mcpServers": {
  "mcp_sbom": {
    "command": "uv",
    "args": [
      "--directory",
      "/path/to/mcp-sbom",
      "run",
      "mcp-sbom"
    ]
  }
}

Building

This project uses uv for orchestration. First synchronize dependencies and update the lockfile to ensure you have the correct versions for your environment.

uv sync

Debugging

If you need to debug, you can use the MCP Inspector to run the local server in a controlled environment.

npx @modelcontextprotocol/inspector uv --directory /path/to/mcp-sbom run mcp-sbom

Windows

On Windows, use Windows-style paths when specifying directories.

C:/Users/gkh/src/mcp-sbom-server/src/mcp_sbom

Available tools

MCP Inspector

Debugging tool to inspect and trace MCP server runs through a visual inspector, helping you verify MCP command flow and runtime behavior.

Trivy Scan

Vulnerability scanning integrated into the MCP SBOM workflow to assess dependencies and components before SBOM generation.

CycloneDX SBOM

Generation of SBOMs in CycloneDX format to catalog software components and their relationships for supply chain transparency.