C

cyclonedx

Fail-closed VEX disposition engine for Iron Bank container findings. Joins findings against public sources (Red Hat CSAF, GitLab CNA, OSV) and emits cited triage worksheets, OpenVEX, and CycloneDX 1.7 VDR.

Analyzer that scans for application dependencies.

[Reference tool] Analyze SBOM dependency graph complexity to predict BuildDependencyGraphWorker performance. CycloneDX and SPDX 2.3. No compiled artifact.

BETA: Dependency Scanning for supported projects

Convert CycloneDX JSON or XML docs to PDF reports. Was designed to work for VEX reports but can also generate PDFs for standard BoMs.