The SBOM your build just produced, taken to the point where you can send it

Drop the CycloneDX or SPDX document. A real reader parses it in your browser — no upload, no converter — and scores the seven NTIA minimum elements, grades twelve conformance checks, classifies every licence expression, and walks the dependency graph for the references that point at nothing. Then pick a lane: the publish gate, the licence rulings, the exposure triage, or the fix plan and the statement that goes with it.

Both examples ship with a saved model run for every lane, so you can see the whole output — the publish decision, the licence rulings, the triage order and the customer statement — without signing in and without spending a credit.

Your SBOM document nothing loaded yet

Drag the file in, or Everything is read in your browser. Nothing uploads until you run a lane.

How this software reaches its users

Your licence policy

Who receives this document

Context — optional, but it changes the rulings

Load an SBOM to price the run.

posture

format

components

NTIA elements passed

findings

Findings

Conformance checks

Each one was decided in your browser first. Where the model changed a status it has to say why, and the browser's own verdict is shown next to it.

Check	Status	Evidence	What it means here

NTIA minimum elements

The seven data fields a federal buyer scores against. Each is a share of components, not a yes or no — "supplier name present" means nothing without saying for how many.

Element	Status	Gap	How to close it

Licence rulings

One ruling per distinct licence expression in the document, against your policy and your shipping model. resolve means the information is missing, not that the policy forbids it — those are different problems with different owners.

Licence	Class	Components	Ruling	Obligation

Exposure triage

This page has no vulnerability database and the model is instructed not to pretend otherwise. What is below is exposure reasoning — graph position, pinning, and whether a scanner could match the component at all — which is where a real scan should be pointed first.

Target	Exposure	Priority	Action	Verify

Fix plan

In the order that unblocks the most. Nothing here is executed by this page — read every command before you run it.

The statement that goes to the customer

Written to be forwarded, so its whole value is in being accurate. Read it against the prescan figures before you send it.

Prescan reconciliation

The free lane exists to keep the paid lane honest. Every flag the browser raised has to be answered exactly once, and the ones the model skipped are named here.

Summary

Raw model reply

The reply did not parse as the structured assessment, so it is shown as it arrived.

What this does, and what it does not

The prescan is a real reader, not a keyword search. Package URLs are parsed rather than pattern-matched, so pkg:npm/@scope/name@1.2.3 resolves to a namespace of @scope and a version of 1.2.3, while pkg:npm/name is reported as pinning nothing and pkg:PyPI/x is flagged because the specification requires a lowercase type and a byte-for-byte comparison downstream will treat it as a different package. SPDX licence expressions are parsed with the operator honoured, which is the difference between right and wrong advice: GPL-3.0-only OR MIT is a choice you get to make and carries no copyleft obligation once you take the MIT branch, while MIT AND GPL-3.0-only stacks both. A substring search for "GPL" cannot tell those apart. Retired identifiers are named with their replacement, because GPL-2.0 is silent on whether later versions may be used and GPL-2.0-only is not — and that is precisely the question compliance has to answer.

SPDX's licenseConcluded and licenseDeclared are read as the two different statements they are, so an SBOM author's own homework is not mistaken for missing data. The dependency graph is walked from the declared subject, so a document whose dependencies key is present but lists only the root is reported as having no graph rather than as having one. Licences that are published but not OSI-approved — BUSL, SSPL, Elastic, the PolyForm family — get their own class, because an allow-list built on the word "open source" lets every one of them through.

It reads. It never modifies your document, never uploads it, never runs a scanner or a validator, and has no vulnerability database — so it will not tell you whether a component is affected by anything, and the model is instructed to refuse to invent a CVE identifier or a score. What the triage lane gives you instead is where to point a real scan, and the most useful thing it usually says is structural: components with no purl and no CPE are not clean, they are unscanned. The prescan figures are computed locally and are reliable; the lanes are written by a language model and are advice, not a certification, and nothing here is legal advice.

Nothing to hand? Load the — 1.5, no suppliers, a caret version, a retired GPL identifier and three components nothing points at — or the , well populated but carrying an AGPL component and a source-available one. Both replay a saved run for every lane, for free.

The SBOM your build just produced, taken to the point where you can send it

Instant prescan — free, in your browser, no model

Findings

Conformance checks

NTIA minimum elements

Publish gate

Must change before it goes out

Must be said out loud if it goes out as it is

Licence rulings

Obligations this creates

What an attribution notice cannot be built from this document

Exceptions that would have to be granted

Exposure triage

Blind spots — what no scanner can see given this document

What to watch afterwards

Vulnerability records embedded in the document

Fix plan

Verify

The statement that goes to the customer

Still true after all of the above

Prescan reconciliation

Assumptions and open questions

Summary

Raw model reply

Your recent assessments

If that did not work

What this does, and what it does not