Provetry
FRDEGet early access
Free check
Get early access

Provetry opens in November 2026. The free CRA check, the tools and the guides are available now.

Free tool

SBOM generator

Pick your project folder or its lock files: get a software bill of materials in CycloneDX 1.6 or SPDX, ready for the Cyber Resilience Act, with the direct dependencies marked.

Runs entirely in your browser: nothing you type or open is sent to us or stored.

Only lock files and manifests are read; node_modules, build output and the rest are skipped.
package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, Pipfile.lock, poetry.lock, uv.lock, go.mod, Cargo.lock, composer.lock, Gemfile.lock, packages.lock.json, gradle.lockfile, pom.xml. Add package.json, pyproject.toml, Cargo.toml or composer.json to mark the direct dependencies. For several projects in one repository, pick the folder.
Format

What this SBOM covers, and what it does not

The SBOM lists what your lock files pin: every package with its exact version and package URL (purl), the direct dependencies marked when a manifest says which they are, and the development dependencies marked as not shipped. It is generated by the same open-source engine as Provetry, provetry-core, here in your browser.

A lock file does not see everything you ship: C libraries bundled in Python wheels or Rust -sys crates, the packages of a container image, a runtime you include. A pom.xml alone gives the direct dependencies only; for the full Java tree, use the CycloneDX Maven or Gradle plugin. The ecosystem guides say what to add for each case.

From 11 December 2027, Annex I, Part II of the Cyber Resilience Act asks for an SBOM in a commonly used, machine-readable format covering at least the top-level dependencies. CycloneDX and SPDX both qualify; it belongs to the technical documentation and does not have to be published.

provetry-core is free software under the AGPL-3.0 licence: its source code.

One SBOM is a snapshot

The CRA expects it current at every release, and the vulnerabilities in it watched every day. Provetry builds it from your CI at each release tag, keeps every release’s copy and tells you when an exploited vulnerability hits one of its components. How Provetry works →

Other free tools

  • security.txt generator and checker

    Write the RFC 9116 file that tells researchers where to report a vulnerability, or check the one you have.

  • CVSS 3.1 calculator

    Score a vulnerability from its eight base metrics, or paste a vector to read it.

  • CVSS 4.0 calculator

    The newer version of CVSS, scored with FIRST’s reference calculation: base metrics, or any vector pasted.

  • EPSS score lookup

    How likely a vulnerability is to be exploited in the next 30 days: today’s score from FIRST, for up to 30 CVEs at once.

  • Vulnerability disclosure policy generator

    A coordinated vulnerability disclosure policy for your products, ready to publish, in English, French or German.

  • SBOM viewer and checker

    Open a CycloneDX or SPDX file: its components, and what the CRA expects that is missing.