Trivy does the scanning; the value here is that the output arrives as CycloneDX inside the assistant's context, where it can be read, compared and acted on rather than saved to a file someone opens later. The prerequisites are the honest cost: Trivy has to be installed and working on the machine first, since the server drives it rather than replacing it.
An MCP server that wraps Trivy to produce an SBOM. It gives an assistant a direct route from a target to a CycloneDX document — the standard format supply-chain tooling and audits expect.
- A Trivy scan driven from the client, with the result returned as a CycloneDX SBOM
- A stdio server that registers as a plain `uv` command entry in any MCP client
Three things installed before it will run: `uv`, `trivy` and Node.js. Synchronise dependencies with `uv sync`, then configure the client to run `uv --directory /path/to/mcp-sbom run mcp-sbom`. On Windows use forward-slash style paths in the configuration. Debugging goes through the MCP Inspector, launched with `npx @modelcontextprotocol/inspector` against the same command. The package is `mcp-sbom` (0.1.0 in pyproject).