sbomqs is the industry-leading tool for evaluating SBOM quality, ensuring compliance, and managing your software supply chain security. From quality scoring to compliance validation, component analysis to vulnerability tracking - sbomqs provides everything you need to work with SBOMs effectively.

"sbomqs is listed as a relevant tool in the SBOM ecosystem" - SBOM Generation White Paper, 2025

"sbomqs is listed as an open-source tool under Quality/Score and Cryptographic Signing categories" - ENISA Technical Advisory for Software Bill of Materials, v1.10

Get started with SBOM compliance in under two minutes — no credit card, no time limit. Interlynk's free plan includes a guided setup where you pick your compliance standard (CRA/EU, FDA Cybersecurity, NTIA, or Telecom), upload your SBOM, and instantly see your compliance score with actionable gaps highlighted. You get compliance scoring against one standard, up to 5 products with 5 versions each, unlimited users, built-in vulnerability detection, API access for CI/CD integration, weekly compliance digests, and ShareLynk — a public link to share your compliance posture with customers and partners. Everything beyond the free tier is visible with a clear upgrade path, and you can start a 15-day Enterprise trial anytime to unlock unlimited products, SBOM automation, RBAC, analytics, license management, and workflow integrations. Get Started Free →

📊 Check your SBOM compliance instantly directly from your browser in just one click: https://demo.interlynk.io/

# Install via Homebrew
brew tap interlynk-io/interlynk
brew install sbomqs

# Get your first quality score
sbomqs score your-sbom.json

📚 Full Getting Started Guide - Installation for all platforms and basic usage

In today's software landscape, understanding and managing your software supply chain is critical. Whether you're in healthcare dealing with FDA requirements, automotive following NHTSA guidelines, or any regulated industry, sbomqs helps you:

• Instantly assess SBOM quality - Know if your SBOMs meet quality standards
• Ensure compliance - Validate against BSI, NTIA, FSCT, and industry standards
• Find vulnerabilities - Identify components missing security identifiers
• Automate workflows - Integrate into CI/CD pipelines with ease
• Share results - Generate shareable reports and quality scores
• Using as library - Integrating sbomqs into your software programatically

✅ Multi-Standard Support: SPDX, CycloneDX
✅ Compliance Validation: BSI TR-03183-2 (v2.1.0, v2.0 & v1.1), FSCT v3, OpenChain Telco, NTIA
✅ Quality Scoring: 0-10 scale with detailed breakdowns
✅ Component Analysis: List, filter, and analyze SBOM components
✅ Integration Ready: Docker, CI/CD, Dependency-Track, GitHub Actions
✅ Shareable Reports: Generate public quality score links
✅ Air-Gapped Support: Works in isolated environments

📚 Getting Started - Installation and basic usage

• score - Calculate SBOM quality score
• compliance - Check regulatory compliance
• list - List and filter components
• share - Generate shareable reports
• dtrackScore - Dependency-Track integration
• generate - Generate configuration files
• version - Version information

• Customization - Create custom scoring profiles
• Weightage Scoring - Customize scoring weights and categories
• Integrations - CI/CD and tool integrations
• Policy - Policy enforcement and validation

• Quality Checks - All scoring criteria explained
• Compliance Standards - BSI, NTIA, FSCT mappings

# Get a quality score (0-10)
sbomqs score -b samples/photon.spdx.json

# See detailed breakdown
sbomqs score samples/photon.spdx.json

# Check specific category, other supported categories are: [identification, provenance, integrity, completeness, licensing, vulnerability, structural, cinfo]
sbomqs score samples/photon.spdx.json --category integrity

# check NTIA-minimum-elements category for legacy scoring
sbomqs score samples/photon.spdx.json --category NTIA-minimum-elements --legacy

# Use custom weights configuration
sbomqs score samples/photon.spdx.json --configpath my-weights.yaml

See Weightage Scoring Guide for details on customizing scoring weights.

# BSI TR-03183-2 v2.0
sbomqs compliance --bsi-v2 samples/photon.spdx.json

# FSCT v3
sbomqs compliance --fsct samples/photon.spdx.json

# OpenChain Telco
sbomqs compliance --oct samples/photon.spdx.json

# Score comprehensive features (default profile)
sbomqs score samples/photon.spdx.json --feature comp_with_name,comp_with_version

# Score NTIA-specific features
sbomqs score samples/photon.spdx.json --profile ntia --feature comp_name,comp_version,sbom_timestamp

# Score BSI v2.1-specific features
sbomqs score my-app.cdx.json --profile bsi --feature sbom_spec_version,sbom_creator,comp_name

# Score with JSON output for automation
sbomqs score samples/photon.spdx.json --profile ntia --feature comp_name --json

# Components without versions
sbomqs list samples/photon.spdx.json --feature comp_with_version --missing

# Components without suppliers
sbomqs list samples/photon.spdx.json --feature comp_with_supplier --missing

# Show actual supplier values for all components
sbomqs list samples/photon.spdx.json --feature comp_supplier --show

# Inspect a compliance profile field (e.g. BSI v2.1 deployable hash)
sbomqs list --profile bsiv21 --feature comp_deployable_hash --missing my-app.cdx.json

# Browse all features supported by a profile
sbomqs features --profile ntia

# Generate shareable link (doesn't upload SBOM content)
sbomqs share samples/photon.spdx.json

package main

import (
   "context"
   "fmt"

   "github.com/interlynk-io/sbomqs/v2/pkg/scorer/v2/config"
   "github.com/interlynk-io/sbomqs/v2/pkg/scorer/v2/score"
)

func main() {
   cfg := config.Config{}
   // make sure current dir has sbom file: `sbom.cdx.json`
   paths := []string{"sbom.cdx.json"}

   results, err := score.ScoreSBOM(context.Background(), cfg, paths)
   if err != nil {
      log.Fatalf("scoring failed: %v", err)
   }

   for _, r := range results {
      // Comprehensive result is the default evaluation
      if r.Comprehensive != nil {
         fmt.Printf("Interlynk score: %.2f  Grade: %s\n", r.Comprehensive.InterlynkScore, r.Comprehensive.Grade)
      }
   }

For more examples, refer here: https://github.com/interlynk-io/sbomqs/blob/main/docs/guides/integrations.md

• Healthcare & Medical Devices: Meet FDA SBOM requirements for medical device submissions
• Automotive: Comply with NHTSA cybersecurity guidelines for vehicle software
• Financial Services: Support DORA and PCI DSS software transparency requirements
• Telecommunications: Ensure critical infrastructure security with OpenChain Telco
• Enterprise Software: Manage supply chain risk with comprehensive quality metrics

We welcome contributions! Here's how to get started:

1. Fork the repository
2. Create your feature branch (git checkout -b feature/amazing-feature)
3. Commit your changes (git commit -sam 'Add amazing feature')
4. Push to the branch (git push origin feature/amazing-feature)
5. Open a Pull Request

Please ensure:

• All commits are signed
• Tests pass (make test)
• Code follows our style guide (make lint)

📖 Contributing Guidelines

sbomqs has gained significant adoption across the industry for SBOM quality assessment and compliance validation:

1. Soeiro, L., Robert, T., & Zacchiroli, S. (2025)
   Wild SBOMs: a Large-scale Dataset of Software Bills of Materials from Public Code
   22nd IEEE/ACM International Conference on Mining Software Repositories (MSR 2025)
   DOI: arXiv:2503.15021
   Usage: Uses sbomqs to compute quality scores for over 78,000 SBOMs in their large-scale dataset from 94 million GitHub repositories.
2. Novikov, O., Fucci, D., Adamov, O., & Mendez, D. (2025) POLICY-DRIVEN SOFTWARE BILL OF MATERIALS ON GITHUB: AN EMPIRICAL STUDY arXiv preprint DOI: arXiv:2509.01255 Usage: Uses sbomqs to assess the quality of 620 policy-driven SBOMs found on GitHub, calculating a quality score based on structural and semantic completeness.

2. SBOM Generation White Paper (2025)
   SBOM Community, February 2025
   Citation: Lists sbomqs as a "relevant tool in the SBOM ecosystem" and highlights it as demonstrating best practices in SBOM quality assessment.

3. OpenChain Telco SBOM Guide v1.1 (2025)
   OpenChain Project
   URL: OpenChain Project
   Usage: References sbomqs as a recommended tool for telecommunications operators managing complex software supply chains, particularly for its ability to validate SBOMs across multiple formats.

• Company: Harness Inc.
• Usage: Uses sbomqs as the engine powering their SBOM quality scoring feature
• Features: Provides quality scores from 1-10 for generated SBOMs with SBOM drift detection capabilities
• Reference: Harness Developer Hub
• Blog Post: Level Up your Zero-day Vulnerability Remediation and SBOM Quality (May 2025)

• Platform: sbom.sh
• Usage: Uses the sbomqs engine to evaluate and score uploaded SBOMs
• Features: Automatically generates a quality score (1–10) based on metadata completeness, component coverage, and spec compliance (SPDX/CycloneDX), displaying results directly in the web interface

• Platform: sbombenchmark.dev
• Usage: Uses the sbomqs engine for scoring CycloneDX and SPDX SBOMs
• Features: Provides shareable quality reports without requiring SBOM uploads

• Company: Interlynk Inc.
• Milestone: Reached 100 customers on community tier, including four Fortune 500 companies
• Integration: sbomqs integrated for SBOM quality assessment across the platform

• Platform: SBOMly.
• Usage: Uses the sbomqs engine for scoring CycloneDX and SPDX SBOMs to check how complete and useful SBOMs are.
• Features: SBOMly makes it easy to scan your project dependencies for known vulnerabilities. It generates SBOM using Syft, then scan it for vulnerabilities using both Grype and OSV-Scanner for comprehensive coverage and gives detailed report showing all components, vulnerabilities, severity levels, and fix commands you can run to remediate issues.

• GitHub Actions via Docker (ghcr.io/interlynk-io/sbomqs)
• Homebrew (brew install sbomqs)
• Go modules (go install)
• Docker Hub & GitHub Container Registry
• Uniget tools repository

Trusted for validating compliance with:

• NTIA Minimum Elements
• BSI TR-03183-2 (v1.1 & v2.0)
• OpenChain Telco (OCT)
• Framing Software Component Transparency (FSCT v3)

Interlynk provides a comprehensive suite of SBOM tools:

• SBOM Assembler - Complete SBOM toolkit (Merging/Enriching/Signing and Editing)
• SBOM Explorer - Search and download from public repositories
• SBOM Search Tool - Context-aware repository search
• SBOM Seamless Transfer - Transfer between systems
• SBOM Benchmark - Repository of SBOM quality scores

• sbomqs and SBOM Policies: Turning Transparency Into Action
• sbomqs scoring support for BSI-1.1 and BSI-2.0
• What’s Missing in Your SBOM? sbomqs List...

• ❓ Community Slack
• 💬 Live Chat
• 📧 Email
• 🐛 GitHub Issues
• 🐦 Follow us on X

If sbomqs helps you improve your SBOM quality and compliance, please ⭐ this repository!

sbomqs - Building trust in software supply chains, one SBOM at a time.

Made with ❤️ by Interlynk.io