Low Severity
Published: Oct 25, 2026
Generate a CycloneDX SBOM directly from an unpacked firmware root filesystem and flag components with known CVEs and EOL kernels.
<a name="top"></a>
<div align="center">
<img src="https://capsule-render.vercel.app/api?type=rect&color=0:6b46c1,100:2b6cb0&height=120§ion=header&text=SBOMB&fontSize=48&fontColor=ffffff&fontAlignY=58" width="100%" alt="SBOMB"/>
# SBOMB
### Generate a CycloneDX SBOM directly from an unpacked firmware root filesystem and flag components with known CVEs and EOL kernels.
<img src="https://readme-typing-svg.demolab.com?font=Fira+Code&size=18&duration=3500&pause=1000&color=6B46C1¢er=true&vCenter=true&width=720&lines=Generate+a+CycloneDX+SBOM+directly+from+an+unpacked+firmware;Self-hostable+%C2%B7+MCP-native+%C2%B7+CI-ready+%C2%B7+polyglot" width="720"/>
[](https://pypi.org/project/cognis-sbomb/) [](https://github.com/cognis-digital/sbomb/actions) [](LICENSE) [](https://github.com/cognis-digital)
*IoT / OT / Embedded — firmware, buses, and device security.*
</div>
```bash
pip install cognis-sbomb
sbomb scan . # → prioritized findings in seconds
```
<!-- cognis:example:start -->
## 🔎 Example output
Real, reproducible output from the tool — runs offline:
```console
$ sbomb-emit --version
sbomb 0.1.0
```
```console
$ sbomb-emit --help
usage: sbomb [-h] [--version] {scan,match,feeds,mcp} ...
Generate a CycloneDX SBOM from an unpacked firmware rootfs and flag known-vuln components.
positional arguments:
{scan,match,feeds,mcp}
scan Scan an unpacked rootfs and emit an SBOM.
match Match components against the bundled 262k-record
offline OSV DB.
feeds Manage the bundled threat/vuln data f