About this utility
How to use SBOM Quality & VEX Auditor
Audit CycloneDX or SPDX JSON for component identity, versions, licenses, hashes, package URLs, duplicates, and VEX assessment state.
What to provide
Paste a local SBOM. The audit evaluates only bundled evidence and never queries advisory services.
- Paste, type, or drag and drop a supported text file into the input area.
- Review the input and the clearly labeled output behavior.
- Select “Run tool” or press Ctrl/Command + Enter, then copy, download, or move the result back into the first input for another pass.
What the result means
Component completeness findings plus VEX vulnerability-state summaries.
Privacy and safety
This utility is loaded as browser code and processes your input only in this tab. OmniCastConverter has no upload endpoint and never stores your content, filenames, tokens, or secrets. Generated markup and code are shown as inert text and are never executed.
Limitations
- All input and output remains in this browser tab and is never uploaded or saved. Missing evidence is a quality gap, not proof of vulnerability. Current risk requires a trusted, current advisory source outside this offline tool.
Try the included example
Select “Load example” at any time to restore this tested sample.
{"bomFormat":"CycloneDX","specVersion":"1.6","components":[{"type":"library","bom-ref":"pkg:npm/example@1.0.0","name":"example","version":"1.0.0","purl":"pkg:npm/example@1.0.0","licenses":[{"license":{"id":"MIT"}}],"hashes":[{"alg":"SHA-256","content":"abc"}]}],"vulnerabilities":[{"id":"CVE-2099-0001","analysis":{"state":"not_affected","justification":"code_not_reachable"},"affects":[{"ref":"pkg:npm/example@1.0.0"}]}]}