Generate SBOMs, scan vulnerabilities, and analyze dependencies from local projects or Git repos.
https://mcp.sbomapp.com/mcpHeaders: Authorization
Add this server entry to the mcpServers object in your Claude Desktop config, then restart the app.
{
"mcpServers": {
"io-github-mcpsbom-sbom-mcp": {
"url": "https://mcp.sbomapp.com/mcp"
}
}
}~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.jsonNo remote HTTP endpoint is advertised. Use the package or stdio setup shown in Install.
Paste an API key, bearer token, or session value from the provider. It is used once to list inventory and discarded after the request.
Bearer token (API key) for authentication. Get your API key from https://sbomapp.com
SBOMApp - SBOM Generator & Vulnerability Scanner is an MCP server for Generate SBOMs, scan vulnerabilities, and analyze dependencies from local projects or Git repos.. It supports HTTP transport.
Use the generated config in Install. It points your client at the advertised remote endpoint shown on this page.
Choose the Claude Desktop tab in Install, copy the config, and add it to Claude Desktop's MCP server settings. Endpoint: https://mcp.sbomapp.com/mcp.
Choose the Claude Code tab in Install, copy the config, and add it to Claude Code's MCP server settings. Endpoint: https://mcp.sbomapp.com/mcp.
Choose the Codex tab in Install, copy the config, and add it to Codex's MCP server settings. Endpoint: https://mcp.sbomapp.com/mcp.
Choose the Cursor or VS Code tab in Install, copy the config, and add it to Cursor or VS Code's MCP server settings. Endpoint: https://mcp.sbomapp.com/mcp.
SBOMApp - SBOM Generator & Vulnerability Scanner uses HTTP transport. Endpoint: https://mcp.sbomapp.com/mcp.
SBOMApp - SBOM Generator & Vulnerability Scanner inventory is listed when the MCP endpoint exposes tools, resources, or prompts. Some servers require auth first.
SBOMApp - SBOM Generator & Vulnerability Scanner is marked with Auth required by registry metadata auth. You may need provider login, an API key, a bearer token, or a session header.