> ## Documentation Index
> Fetch the complete documentation index at: https://docs.superblocks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SBOM

> View and download the software bill of materials for a Superblocks application in CycloneDX format

Superblocks indexes the npm packages in every application and exposes them as a **software bill of materials (SBOM)**. Security and platform teams get the package inventory without asking builders for it, and can feed the export into their own scanners and asset inventory.

Each SBOM belongs to one application at one commit. It lists the declared and resolved version of every direct and transitive dependency, and marks the ones with a known advisory.

## View an SBOM

1. Open **Security Center** under **Security** in the dashboard
2. On the **Applications** tab, find the application
3. Click **View details**
4. The **Packages** tab lists the indexed packages

| Column              | What it shows                                                                          |
| ------------------- | -------------------------------------------------------------------------------------- |
| **Package**         | The npm package name, linked to its npm page                                           |
| **Declared**        | The version range declared in `package.json`                                           |
| **Resolved**        | The exact version the lockfile resolved to, or `-` if it could not be determined       |
| **Type**            | **Direct** if the application declares it, **Transitive** if a dependency pulled it in |
| **Vulnerabilities** | A severity badge linked to the advisory on [osv.dev](https://osv.dev), or `-`          |

### Choose a commit

The commit picker at the top of the table selects which snapshot you are looking at. It defaults to the **Deployed** commit, which is what is live for end users. Switch to **Latest** or any other indexed commit to see the package set at that point.

Packages are indexed when a commit is created and when an application is deployed, so an application that has never been deployed shows an empty table until it is.

## Download an SBOM

Click **Download SBOM** on the Packages tab. The file covers the commit currently selected in the picker.

|               |                                                |
| ------------- | ---------------------------------------------- |
| **Format**    | CycloneDX 1.5, JSON                            |
| **File name** | `{application-name}-sbom-{commit-id}.cdx.json` |
| **Scope**     | One application at one commit                  |

Each component in the document carries the package name, the resolved version, and a Package URL (`pkg:npm/...`), which is what most SBOM tooling keys on. The root component in `metadata` identifies the application, and its version is the commit ID, so two exports of the same app are directly comparable.

## Programmatic access

Use the [Superblocks MCP server](/admin/mcp-server) to pull SBOMs without the dashboard.

| Tool                            | What it returns                                                                                                           |
| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| `get_app_sbom`                  | The CycloneDX 1.5 document for one application. Defaults to the deployed commit; pass a commit ID for a specific snapshot |
| `find_apps_by_package`          | Every application using a given package                                                                                   |
| `list_distinct_packages_in_org` | The distinct package footprint across the whole organization. Requires `policies:manage`                                  |

`list_distinct_packages_in_org` is the org-wide view. The Security Center SBOM is per application, so use the MCP tool when you need one inventory across the fleet rather than an app-by-app export.

## Limits

* **Ecosystem:** npm only
* **Package cap:** 2,000 packages per commit are indexed
* **Applications:** an application with no indexed commit has no SBOM

## Permissions

An SBOM follows the same access rule as the rest of Security Center: `policies:view` reaches every application in the organization, and edit access reaches one application.

| Action                                           | Permission                                          |
| ------------------------------------------------ | --------------------------------------------------- |
| View or download the SBOM for any app in the org | `policies:view`                                     |
| View or download the SBOM for one app            | Edit access on that application                     |
| `get_app_sbom`                                   | `policies:view`, or edit access on that application |
| `list_distinct_packages_in_org`                  | `policies:manage`                                   |

Admin and Owner get both `policies` actions by default.

## Related

* [CVE detection](/admin/code-security/supply-chain/cve-detection)
* [CVE notifications](/admin/code-security/supply-chain/cve-notifications)
* [Private registries](/admin/code-security/supply-chain/private-registries)
* [Superblocks MCP server](/admin/mcp-server)