LabscoMCP early access ↗
gkhaysMCP SERVER

MCP SBOM Server

Runs a Trivy scan and returns a software bill of materials in CycloneDX format.

by gkhays ↗Package Registries & Dependency Supply ChainCommunity

LABSCO SUMMARY

A scanner you already trust, reachable from the conversation.

Trivy does the scanning; the value here is that the output arrives as CycloneDX inside the assistant's context, where it can be read, compared and acted on rather than saved to a file someone opens later. The prerequisites are the honest cost: Trivy has to be installed and working on the machine first, since the server drives it rather than replacing it.

What it is

An MCP server that wraps Trivy to produce an SBOM. It gives an assistant a direct route from a target to a CycloneDX document — the standard format supply-chain tooling and audits expect.

What you get

  • A Trivy scan driven from the client, with the result returned as a CycloneDX SBOM
  • A stdio server that registers as a plain uv command entry in any MCP client

Requirements

Three things installed before it will run: uv, trivy and Node.js. Synchronise dependencies with uv sync, then configure the client to run uv --directory /path/to/mcp-sbom run mcp-sbom. On Windows use forward-slash style paths in the configuration. Debugging goes through the MCP Inspector, launched with npx @modelcontextprotocol/inspector against the same command. The package is mcp-sbom (version 0.1.0).

Setup effort

Follow the published steps — uv sync

See installation options