SBOM source enrichment

About

SBOM source enrichment

Upload a Software Bill of Materials and get it back with an authoritative source link for every component it can identify, plus an evidence report you can review. It closes the common SBOM gap where a component is listed by name and version but with no link to its sources.

What you get back

Enriched SBOM
Your original document, unchanged byte-for-byte, with source references added to each component.
Evidence report
A companion file listing every candidate link considered and why it was accepted or rejected.

References it adds

Per component, wherever it can find them: repository, issue tracker, website, documentation, distribution, and license.

Most reliable for repository and issue-tracker links, especially when a package URL (purl) is present. License and documentation are weaker.

How it decides what to trust

For each component a language model cross-checks independent sources: deps.dev, ecosyste.ms, web search, and the candidate pages themselves. A reference is accepted only when two independent signals agree, or one authoritative package-registry signal confirms it. This guards against linking to a different project that merely shares the name.

Two modes

Hybrid (default)
Uses deterministic registry data (Snyk parlay via ecosyste.ms) for components that carry a package URL — no tokens spent on them — and the agent only resolves or discovers the rest. Cheaper and faster, but registry-sourced references are trusted without the identity gate, and parlay may fill empty identity fields and add ecosystems:* properties, so the output is not byte-clean.
Agent
Every component goes through the language model and the two-signal identity gate. Strictest and cleanest, but costs more.

Data handling

Enrichment sends component names, versions, and package URLs to external services (deps.dev, ecosyste.ms, and a web-search provider) and fetches candidate web pages. Do not upload an SBOM whose component list is confidential.

Before you rely on the results

SBOM file

Accepts CycloneDX JSON or SPDX JSON.

Options

Mode