BomLens is a local-first SBOM generator and open-source risk assessor. It produces a CycloneDX SBOM, an open-source notice, and a security and license risk report for a single project in seconds — from source code, a container, a binary, firmware, an SBOM you received, or a HuggingFace AI model. CLI or browser UI, no SaaS.
한국어 문서: sktelecom.github.io/bomlens/ko. 한국어로 질문하거나 이슈를 남겨도 됩니다.
Try it without installing anything: the live demo holds one finished scan of each kind — a Spring Boot project from source, a container image (1,393 components), a Raspberry Pi OS device image as firmware, an AI model as a CycloneDX ML-BOM checked against the G7 minimum elements, and a supplier SBOM checked against the format requirements. Read-only, nothing to install, nothing uploaded. To run your own scans, download the installer for Windows or macOS, or go straight to the CLI.
SK Telecom asks its suppliers to submit an SBOM, and BomLens was built so that a supplier can produce one that meets the submission requirements, understand what is in its software, and act on the vulnerabilities found. The skt-submission conformance profile checks an SBOM against those requirements (see the supplier SBOM guide). Anyone can use it, whether or not they supply SK Telecom.
BomLens runs on one machine, which makes it easy to install and use but means it does not manage a whole organization's open source. For company-wide governance (project inventory, vulnerability triage, license policy gates) SK Telecom uses TRUSCA, an open source SCA platform that can run BomLens as its scan engine. BomLens output is CycloneDX, so it can be uploaded to TRUSCA or to Dependency-Track (see the upload guide).
One Docker image, two jobs. It generates: scan your source code, a container image, or a binary and get a CycloneDX SBOM, an open-source notice, and a security report. It also assesses open-source risk in what you receive — a supplier's finished SBOM (--analyze) or a firmware binary — reporting licenses and known vulnerabilities with Critical-7d / High-30d remediation deadlines. Every scan emits the risk report by default. Originally built by SK Telecom for supply-chain security, now open source.
Languages: Java, Python, Node.js, Ruby, PHP, Rust, Go, .NET, Swift, C/C++ (Conan/vcpkg, or --identify-vendored when there is no package manager), Modelica (annotation(uses(...)) only — the libraries a .mo file directly declares, no lockfile or transitive resolution). Inputs: a source folder, a GitHub URL, a ZIP archive, a Docker image, a binary or RootFS, an existing SBOM, a Yocto build directory, firmware, a HuggingFace AI model (CycloneDX ML-BOM checked against the G7 minimum elements for AI, which map to the EU AI Act's Annex IV), an AI model file read offline from its own header (GGUF, safetensors, PyTorch, ONNX and more), a published research dataset from a Figshare item or a HuggingFace dataset, or a model not yet published, described from its publisher's declaration (--ai-declare). AI model and dataset scans also write an SPDX 3.0.1 document with the AI and Dataset profiles; what a scan cannot know (release dates, makers, how each dataset was used) is asked for in the web UI rather than guessed.
The project is under active development at SK Telecom's open source program office. Releases go out every week or two, and every change runs through CI covering ShellCheck, the scanner integration tests, the web UI contract tests, and a per-language check of the ten example projects.
Full docs — searchable, English and Korean — live at sktelecom.github.io/bomlens, mirrored under docs/:
- First scan (한국어) — install through your first SBOM
- No-CLI quick start (한국어) — click by click, for non-developers
- Input scenarios — GitHub URL, ZIP, local source, an existing SBOM, firmware
- CLI reference — every option and environment variable
- CI/CD integration — gate a pipeline on scan results
- Verify a release — check the signatures and read the SBOM that ships with the image
- What BomLens does not do — the limits we know about
- Contributing to the tool itself — CONTRIBUTING and the architecture
Everything runs on a Docker engine (20.10+). The desktop app and web UI manage the image for you; only the CLI asks you to pull it. On Windows, the desktop app needs Rancher Desktop (free) or Docker Desktop (licensing caveats for larger organizations). WSL2 + docker-ce also works, but for the CLI only: the desktop app cannot see a Docker engine inside WSL2.
Download the installer and double-click it: BomLens-Setup.exe for Windows or BomLens-Setup.dmg for macOS. It checks Docker, pulls the image, and opens the UI — no console window. The app is unsigned for now; if Windows SmartScreen or macOS blocks it, the no-CLI quick start (한국어) shows how to proceed. Build details are in electron/.
git clone --depth 1 https://github.com/sktelecom/bomlens.git && cd bomlens # --depth 1: about 50 MB instead of the full history
./scripts/scan-sbom.sh --ui # opens http://localhost:8080; results save to the current folder
# Windows: double-click scripts\sbom-ui.batPowerShell: don't paste the block above as-is —
.shhas no default handler there, so it fails silently with no error and no output. Double-clickscripts\sbom-ui.batinstead.
The page can take up to a minute to load the first time while the image is checked, so reload the tab if it shows a connection error. Enter a project name and version, pick a scan target (current folder, GitHub URL, ZIP, SBOM, firmware upload, or Docker image), click Run scan, then view or download the results; live logs stream as it runs. To scan a folder outside the launch directory, add --mount <dir> (repeatable, or --mount / for the whole host); the desktop app has an Add folder button for the same.
docker pull ghcr.io/sktelecom/bomlens:latest # aliases: sbom-generator and sbom-scanner serve the same image
./scripts/scan-sbom.sh --project MyApp --version 1.0.0 --target examples/nodejs --all --generate-onlyPowerShell: docker pull above works as-is, but the second line does not — ./scripts/scan-sbom.sh has no default handler in PowerShell and fails silently with no error and no output. Run the same command through scripts\scan-sbom.bat instead (Git for Windows required). Outputs land in a {Project}_{Version}/ subfolder, prefixed {Project}_{Version}_…: bom.json (SBOM), NOTICE.{txt,html}, risk-report.{md,html}, and security.{json,md,html}; add --spdx for an SPDX 2.3 copy. Other inputs and every option are in the CLI reference and the input-scenarios guide.
Issues and PRs welcome — see CONTRIBUTING.md (한국어) and GitHub Issues. For questions, where to ask and what to include are in SUPPORT.md.
Apache License 2.0 · © 2026 SK Telecom Co., Ltd. Bundled third-party tools keep their own licenses — see NOTICE and THIRD_PARTY_LICENSES.md.