Free tool
Check whether your SBOM is a valid CycloneDX or SPDX document and how complete its PURLs are — the package URLs are what vulnerability matching depends on. No signup. Nothing stored.
CycloneDX or SPDX JSON, up to 20 MB.
