Free SBOM checker: Build a software bill of materials and check every dependency for vulnerabilities and licences.

Software composition analysis in your browser, in the style of Dependency-Track and Snyk. Open a package-lock.json, requirements.txt, pom.xml, mvn dependency:tree output or an existing CycloneDX/SPDX SBOM: see every direct and transitive component, the known vulnerabilities from OSV with the version that fixes each, an upgrade plan, and licence verdicts against a policy you can edit. Export the result as CycloneDX 1.5 or SPDX 2.3. Comes with three demo-bank projects (Node, Python, Java) and an offline advisory snapshot; Check online looks up your own packages on osv.dev and deps.dev when you ask.

Free, no login, nothing to install. Your work stays in this browser.

What you can do

• Turn npm, Python and Maven manifests into a full SBOM
• Find known vulnerabilities (Log4Shell and more) with fixed versions and an upgrade plan
• Check licences (GPL, AGPL, LGPL, custom terms) against an editable policy
• Export CycloneDX 1.5 or SPDX 2.3 JSON

Graded, AI-assisted versions live in secure coding, DevSecOps and software supply chain courses.