CycloneDX SBOM vulnerability check — analyze bounded JSON 1.5 software bill of m
CycloneDX SBOM vulnerability check — analyze bounded JSON 1.5 software bill of materials components against OSV and prioritize exact CVE matches from CISA KEV without remote document fetches.
Answeringour last check, 2026-09-24
1 of 1checks answered this week
986 msmedian answer time
$0.02listed price per call
$0.02price it asked us
Paid test badge: not yet. The checks above are free: we call the tool without paying and read the payment request it sends back. The Verified badge needs paid calls whose answers match the promised output, and nobody can buy a badge.
Endpoint
POST https://dependency-risk.use.x402atlas.com/sbom
| Category | Code and developer |
|---|---|
| Provider host | dependency-risk.use.x402atlas.com |
| Networks | eip155:137, eip155:42161, eip155:8453 |
| Payment schemes | exact |
| Self-reported calls, 30 days | 2 from 1 payers (the provider's figure, not ours) |
Our checks, last 30 days
| Day | Result | HTTP | Asked | Time |
|---|---|---|---|---|
| 2026-09-24 | valid payment request | 402 | $0.02 | 986 ms |
Example input (from the provider)
{
"body": {
"document": {
"bomFormat": "CycloneDX",
"components": [
{
"name": "log4j-core",
"purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1",
"type": "library",
"version": "2.14.1"
}
],
"specVersion": "1.5"
}
},
"bodyType": "json",
"method": "POST",
"type": "http"
}
Promised output schema (from the provider)
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"input": {
"additionalProperties": false,
"properties": {
"body": {
"additionalProperties": false,
"properties": {
"document": {
"additionalProperties": false,
"description": "Bounded CycloneDX JSON 1.5 document containing at least one versioned-purl component",
"properties": {
"bomFormat": {
"const": "CycloneDX",
"description": "Required CycloneDX format marker",
"type": "string"
},
"components": {
"description": "Bounded components with canonical versioned purls. The complete OSV result must contain no page token and at most eight distinct vulnerability IDs for V1 enrichment.",
"items": {
"additionalProperties": false,
"description": "Minimal supported CycloneDX component shape for agent-generated requests",
"properties": {
"name": {
"description": "Optional public component name retained only for component-identity conflict checks",
"maxLength": 16384,
"minLength": 1,
"type": "string"
},
"purl": {
"description": "Required canonical package URL containing an embedded exact version",
"maxLength": 2048,
"minLength": 1,
"type": "string"
},
"type": {
"description": "Optional CycloneDX component type retained only for component-identity conflict checks",
"maxLength": 16384,
"minLength": 1,
"type": "string"
},
"version": {
"description": "Optional exact component version; when present it must equal the purl version",
"maxLength": 256,
"minLength": 1,
"type": "string"
}
},
"required": [
"purl"
],
"type": "object"
},
"maxItems": 200,
"minItems": 1,
"type": "array"
},
"specVersion": {
"const": "1.5",
"description": "Supported CycloneDX JSON specification version",
"type": "string"
}
},
"required": [
"bomFormat",
"specVersion",
"components"
],
"type": "object"
}
},
"required": [
"document"
],
"type": "object"
},
"bodyType": {
"enum": [
"json",
"form-data",
"text"
],
"type": "string"
},
"method": {
"enum": [
"POST"
],
"type": "string"
},
"type": {
"const": "http",
"type": "string"
}
},
"required": [
"type",
"method",
"bodyType",
"body"
],
"type": "object"
},
"output": {
"properties": {
"example": {
"additionalProperties": false,
"description": "Complete transactional Dependency Risk response, limited to the native budget reserved below the 512 KiB deployed wire ceiling",
"properties": {
"_atlas": {
"additionalProperties": false,
"description": "Atlas documentation and related-route metadata added after deployment",
"properties": {
"docs": {
"description": "Documentation URL for this bridge",
"format": "uri",
"maxLength": 512,
"type": "string"
},
"related": {
"description": "Bounded related Atlas routes",
"items": {
"additionalProperties": false,
"description": "One related Atlas route",
"properties": {
"bridge": {
"description": "Related bridge name",
"maxLength": 64,
"type": "string"
},
"docs": {
"description": "Related bridge documentation URL",
"format": "uri",
"maxLength": 512,
"type": "string"
},
"summary": {
"description": "Short capability summary",
"maxLength": 256,
"type": "string"
},
"url": {
"description": "Related route URL",
"format": "uri",
"maxLength": 512,
"type": "string"
}
},
"required": [
"bridge",
"url",
"docs",
"summary"
],
"type": "object"
},
"maxItems": 3,
"type": "array"
}
},
"required": [
"docs"
],
"type": "object"
},
"operation": {