SBOMApp

What SBOMApp is

SBOMApp is a software bill of materials platform for enterprises that need to create, analyze, govern, remediate, and share SBOMs across software development. It generates SBOMs from source code, containers, and binaries in SPDX 3.0 and CycloneDX 1.7 formats. Analysis covers direct and transitive dependencies, CVEs, licenses, and build drift. SBOM App Core adds role-based access control, encrypted report links with access controls, and policy-as-code validation across builds. Listed integrations and workflows include GitHub, GitLab, Bitbucket, Jenkins, REST API, and an AI-native MCP. Open-source metadata sources support license visibility and end-of-life detection. Release choices include on-premises, SaaS, AWS and Azure marketplaces, and MCP server deployment. The Air-Gapped Edition can run on premises in Kubernetes, on bare metal, or in a virtual machine with no outbound connectivity. Security capabilities include SSO, audit logs, and end-to-end encryption for sharing. AI Code Insight identifies dependencies, vulnerabilities, licenses, and risks in AI-assisted development, including through a VS Code MCP server. The MCP product uses token-based access and HTTPS; the company says it does not store source code, SBOMs, dependencies, or project data. SBOMApp is made by IARM Information Security. Pricing is customized to application volume, deployment, security capabilities, integrations, compliance, and support requirements.

Who it suits

SBOMApp is aimed at enterprise DevSecOps teams that need SBOM generation, analysis, policy checks, and controlled sharing in development workflows. Its air-gapped edition is intended for defense, government, and regulated healthcare organizations.

Getting started

1. Visit the SBOMApp website.
2. Select a release model: on-premises, SaaS, AWS or Azure marketplace, or MCP server.
3. For an air-gapped deployment, choose on-premises Kubernetes, bare metal, or virtual machine.
4. Request pricing based on application volume, deployment, security capabilities, integrations, compliance, and support.
5. Choose support and service options such as standard support, priority support, onboarding, or dedicated assistance.

Verdict

Choose SBOMApp if your enterprise needs SBOM generation and governance across development, with deployment choices that include on-premises and air-gapped environments. Teams should look elsewhere if they need a published fixed price, since pricing is customized to application, deployment, security, integration, compliance, and support needs.