SBOM Dependency Explorer

How to use SBOM Dependency Explorer

Explore component inventories and declared dependency reachability in CycloneDX 1.6 or SPDX 2.3 JSON without fetching packages. Trace selected direct and transitive relationships, report outside references and expose one cycle witness. Preserve declared license text as unverified metadata while avoiding a security or compliance verdict.

1. Provide optional local json sbom, cyclonedx 1.6 or spdx 2.3 json, optional component reference to explore.
2. Choose the supported mode and run the tool. Review its assumptions and any reported errors.
3. Copy the result or download a separate output; reset to clear the current form.

Good to know

• 500 KB duplicate-free JSON and 40 parsed levels; 1,000 modeled inventory entries, 30 containment levels and 5,000 dependency edges. Metadata strings are at most 2,000 characters and 100,000 displayed characters in aggregate; reports have a separate 500,000-character cap.
• CycloneDX 1.6 models components, nested components, metadata.component, services and dependsOn. Inventory containment and provides are not treated as dependency edges. A component absent from the supplied dependency entries is explicitly shown as unenumerated, never assumed dependency-free.
• SPDX 2.3 models package records and DEPENDS_ON plus the inverse generic/build/dev/optional/provided/test/runtime DEPENDENCY_OF variants. The exact relationship kind is retained. Other relations, files, snippets and external documents are outside this package graph.
• NONE/NOASSERTION dependency relationship values remain explicit assertions, not fabricated package nodes. Reachability uses a union of declared contexts, not a predicted runtime dependency set; missing graph records leave the result partial.
• License strings are source declarations only. No catalog/expression validation, legal obligation, license compatibility, CVE lookup, signature, checksum, completeness, package resolution or external reference fetch is performed.
• Inputs are processed on this device and are not automatically saved or uploaded.