depguard_sbom

MCP tool from Depguard by mopanc

Generate a CycloneDX 1.6 SBOM (EU CRA, US EO 14028, SOC 2, FedRAMP)

How to use it

depguard_sbom is exposed by the Depguard MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the depguard_sbom tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.

Install Depguard

$npx depguard-cli audit express

FULL DEPGUARD LISTING

Other tools in Depguard (13)

depguard_audit

Deep dive on one package (vulnerabilities + static code analysis + install scripts)

depguard_audit_bulk

Compare A vs B vs C in one call

depguard_audit_deep

Full transitive tree audit for one package

depguard_audit_project

Audit a whole project — direct deps, transitives via lockfile, packageManager field

depguard_audit_workspace

Just cloned a repo, before opening it in any IDE. Lists files that auto-execute on workspace open (VS Code tasks runOn:folderOpen, devcontainer lifecycle, .envrc, JetBrains run configs, Makefile, .gitattributes, committed git hooks). Defends against fake-interview / take-home-test malware.

depguard_guard

About to install package Y → pre-install verify + audit + allow/warn/block

depguard_remediate

"100 vulnerabilities, which 5 direct deps do I bump?" — groups transitives by parent, sorted by severity weight

depguard_review

AI code review — detect debris left by AI agents (console.logs, empty catch, broken imports, orphan files)

depguard_score

Score 0-100 for one package

depguard_search

Search npm by keywords, ranked by depguard score

depguard_should_use

Need functionality X → recommend install / use-native / write-from-scratch

depguard_sweep

Find unused dependencies in a project

depguard_verify

AI hallucination guard — does this package exist? Is it a typosquat?