Skip to main content
Superblocks indexes the npm packages in every application and exposes them as a software bill of materials (SBOM). Security and platform teams get the package inventory without asking builders for it, and can feed the export into their own scanners and asset inventory. Each SBOM belongs to one application at one commit. It lists the declared and resolved version of every direct and transitive dependency, and marks the ones with a known advisory.

​
View an SBOM

  1. Open Security Center under Security in the dashboard
  2. On the Applications tab, find the application
  3. Click View details
  4. The Packages tab lists the indexed packages

​
Choose a commit

The commit picker at the top of the table selects which snapshot you are looking at. It defaults to the Deployed commit, which is what is live for end users. Switch to Latest or any other indexed commit to see the package set at that point. Packages are indexed when a commit is created and when an application is deployed, so an application that has never been deployed shows an empty table until it is.

​
Download an SBOM

Click Download SBOM on the Packages tab. The file covers the commit currently selected in the picker. Each component in the document carries the package name, the resolved version, and a Package URL (pkg:npm/...), which is what most SBOM tooling keys on. The root component in metadata identifies the application, and its version is the commit ID, so two exports of the same app are directly comparable.

​
Programmatic access

Use the Superblocks MCP server to pull SBOMs without the dashboard. list_distinct_packages_in_org is the org-wide view. The Security Center SBOM is per application, so use the MCP tool when you need one inventory across the fleet rather than an app-by-app export.

​
Limits

  • Ecosystem: npm only
  • Package cap: 2,000 packages per commit are indexed
  • Applications: an application with no indexed commit has no SBOM

​
Permissions

An SBOM follows the same access rule as the rest of Security Center: policies:view reaches every application in the organization, and edit access reaches one application. Admin and Owner get both policies actions by default.