> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mergeguide.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SBOM export

> Generate a CycloneDX or SPDX Software Bill of Materials from your dependency manifests.

A **Software Bill of Materials (SBOM)** is a machine-readable inventory of the
dependencies in your project. MergeGuide generates one from your dependency
manifests in the standard CycloneDX and SPDX formats.

## Generate an SBOM

```bash theme={null}
# Generate from the current directory (CycloneDX JSON to stdout)
mergeguide sbom generate .

# Write SPDX JSON to a file
mergeguide sbom generate . --format spdx-json -o sbom.json

# Name and version the component
mergeguide sbom generate --name "MyApp" --version "1.0.0" package.json
```

## Supported formats

| Format           | Standard      | Notes                                |
| ---------------- | ------------- | ------------------------------------ |
| `cyclonedx-json` | CycloneDX 1.5 | JSON; widely supported. The default. |
| `cyclonedx-xml`  | CycloneDX 1.5 | XML; legacy-compatible.              |
| `spdx-json`      | SPDX 2.3      | JSON; Linux Foundation standard.     |
| `spdx-tag-value` | SPDX 2.3      | Tag-value; human-readable.           |

List them anytime:

```bash theme={null}
mergeguide sbom formats
```

## Supported manifests

`sbom generate` reads these dependency manifests:

| Ecosystem | Manifests                                       |
| --------- | ----------------------------------------------- |
| npm       | `package.json`, `package-lock.json`             |
| pip       | `requirements.txt`, `Pipfile`, `pyproject.toml` |
| go        | `go.mod`, `go.sum`                              |
| cargo     | `Cargo.toml`, `Cargo.lock`                      |
| maven     | `pom.xml`                                       |
| gem       | `Gemfile`, `Gemfile.lock`                       |
| composer  | `composer.json`, `composer.lock`                |
| nuget     | `packages.config`, `*.csproj`                   |

By default, development dependencies are excluded. Include them with `--include-dev`.

## Options

| Option                | Description                               |
| --------------------- | ----------------------------------------- |
| `-f`, `--format`      | Output format (default `cyclonedx-json`). |
| `-o`, `--output`      | Write to a file (default stdout).         |
| `-n`, `--name`        | Project/component name.                   |
| `--version`           | Project/component version.                |
| `-d`, `--description` | Project description.                      |
| `--include-dev`       | Include dev dependencies.                 |

See [`mergeguide sbom`](/reference/cli#mergeguide-sbom).

## Scan dependencies for vulnerabilities

An SBOM inventories your dependencies; to check them against known vulnerabilities,
run the vulnerability scanner:

```bash theme={null}
mergeguide scan vuln --fail-on critical
```

See [Running scans](/operation/running-scans).

## Next steps

<CardGroup cols={2}>
  <Card title="OSCAL export" icon="file-shield" href="/compliance/oscal-export">
    Export NIST OSCAL compliance evidence.
  </Card>

  <Card title="Compliance overview" icon="clipboard-check" href="/compliance/overview">
    How evidence fits your audit.
  </Card>
</CardGroup>