{
  "markdown": "# SBOM for VS Code by SBOMApp! \n\n# “AI wrote the code – now audit what’s inside” \n\nSBOM MCP Server - SBOMApp MCP Server brings software supplychain security assistant inside VS Code. With a simple natural language prompt, developers can instantly generate SBOMs (SPDX/CycloneDX), scan for CVEs, Verify Licence Compliance, and get actionable remediation guidance.  \n\nNo switching tools, no manual scripts, everything happens right inside your editor, keeping you fast, secure, and focused.  \n\n![alt text](https://res.cloudinary.com/instahippo/image/upload/v1760869330/sbom-label-1.png)\n\n## Why teams choose SBOMApp MCP: \n\nEndtoend visibility: Build complete SBOMs (including transitive deps) from local workspaces or Git repos, then attach them to builds and releases. \n\nActionable security: Run vulnerability scans, drill into CVE details, and get fix versions and upgrade paths. \n\nLicense clarity: Identify copyleft and other risky licenses early with auditfriendly summaries. \n\nCopilot + MCP native: Works naturally in Agent Mode, so prompts like “generate sbom”, “scan vulnerabilities”   \n\nFrictionless onboarding: Start with a 7day free trial or connect your enterprise server using secure tokens stored by VS Code. \n\nDesigned for securityminded engineering orgs: Whether you’re shipping regulated software, hardening your SDLC, or preparing for customer SBOM requests, SBOMApp MCP delivers the SBOM, CVE, and license insights your teams need \n\n# Absolute Privacy Guarantee!\n\nWe don’t store your code, your SBOMs, your dependencies, or any project data — ever. \nOnly your email (for free trial) and API token are stored securely. Everything else stays completely on your machine.\n\n# SBOMApp MCP Server\n\nConnect to a remote SBOM MCP Server to perform software bill of materials analysis, vulnerability scanning, opensource license details and dependency management.\n\n## Quick Start Guide\n\n### Step 1: Install the Extension\n\n1. Open VS Code\n2. Go to Extensions (`Ctrl+Shift+X` or `Cmd+Shift+X` on Mac)\n3. Search for **\"SBOMApp MCP Server\"**\n4. Click **Install**\n\nOr install directly from the [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=iarm-mcp-server.sbom-mcp-server)\n\n\n### Step 2: Free Trial - Get Started Instantly!\n\nNew users get a **FREE 90-day trial** with **100 Tokens** - no credit card required!\n\n#### Automatic Trial Registration:\n1. Install the extension\n2. On first launch, you'll be prompted to start your free trial\n3. Enter your email address\n4. Your API key is automatically configured - you're ready to go!\n\n**Simple steps to Activate Trial!**\n\n**prerequisites** : Visual Studio Code should be Installed with langauage Models enabled.\n\n- Click on the SBOM MCP status bar!\n\n- Click on the start free trial option,\n\n- Click on th start free trial popup,\n\n- Enter your official email-id & click Enter,\n\n- After sucessful Registration, you will get the trial activation notification!\n\n- Reload the Window using the command \"CTRL+SHIFT+P\" or click \"Command Palette\" and Select \"Developer:Reload Window\" to Refresh the MCP Server!\n\n#### Trial Features:\n| Feature | Trial |\n|---------|-------|\n| Validity | 90 days |\n| Token Requests | 100 tokens |\n| SBOM Generation | yes |\n| Vulnerability Scanning | yes |\n\n#### Upgrade to Pro:\nWhen your trial expires or tokens are exhausted, upgrade at: **https://payment.sbomapp.com** or **https://sbomapp.com**\n\n#### Manual Configuration (Enterprise Users):\nIf you have a license key from your administrator:\n1. Press `Ctrl+Shift+P` → **\"SBOMApp: Configure Remote Server\"**\n2. Enter your **Server URL**: `https://mcp.sbomapp.com/mcp`\n3. Enter your **API Key**\n\n### Step 3: Test the Connection\n\n1. Press `Ctrl+Shift+P` again\n2. Type **\"SBOMApp: Test Connection\"** and press Enter\n3. You should see a success message with available tools count\n\n### Step 4: Restart the VS code.\nMandatory step! Once credentials and connections are tested, Kindly restart the VS Code.\n\n### Step 5: Start Using \"@sbomapp\" in chat box\n\nOnce connected (green status bar shows ✓), you can ask GitHub Copilot:\n\n> **Note:** Ensure your project is imported in VS Code before using SBOMApp MCP.\n```\n\"@sbomapp/help\"\n\"@sbomapp Generate an SBOM for my current project or \nGenerate an SBOM for my current project\".\n\"@sbomapp scan vulnerabilities\" or \"Check if lodash 4.17.0 has any security vulnerabilities\" \n```\n---\n\n## Features\n\n-  **Easy Configuration**: Simple setup wizard to connect to your SBOM MCP Server\n-  **Secure Authentication**: Bearer token authentication with secure storage\n-  **Connection Testing**: Verify your server connection before use\n-  **Status Bar Indicator**: See connection status at a glance\n-  **Tool Browser**: View all available SBOM analysis tools\n-  **Direct Tool**: Say \"@sbomapp Generate SBOM for my current project\" in chat - it just works!\n\n## Commands\n\n| Command | Description |\n|---------|-------------|\n| `SBOMApp: Start Free Trial` | Register for a free 7-day trial |\n| `SBOMApp: Check Trial Status` | View remaining tokens and expiry |\n| `SBOMApp: Check Token Usage` | View detailed Token usage statistics |\n| `SBOMApp: Configure Remote Server` | Set up server URL and API key |\n| `SBOMApp: Test Connection` | Verify connection to the server |\n| `SBOMApp: Show Available Tools` | Browse available SBOM analysis tools |\n| `SBOMApp: Disconnect` | Disconnect from the server |\n\n## Configuration\n\nThis extension provides the following settings:\n\n| Setting | Description | Default |\n|---------|-------------|---------|\n| `sbomRemoteMcp.serverUrl` | URL of the remote SBOM MCP Server | (empty) |\n| `sbomRemoteMcp.apiKey` | API key for authentication | (empty) |\n| `sbomRemoteMcp.autoConnect` | Auto-connect on VS Code startup | `true` |\n| `sbomRemoteMcp.showStatusBar` | Show status in status bar | `true` |\n\n## Available Tools\n\nOnce connected, you can use these SBOM analysis tools with GitHub Copilot:\n\n| Tool | Description |\n|------|-------------|\n| `sbomapp_generateSbomFromWorkspace` | Generate SBOM, scan vulnerabilities, analyze dependencies, and check licenses for your **current project** |\n| `generate_sbom` | Generate a complete SBOM with vulnerability report for your project |\n| `scan_vulnerabilities` | Scan your project for security vulnerabilities with CVE details |\n| `analyze_dependencies` | Analyze all dependencies — types, licenses, and risk assessment |\n\n> **Tip:** Just type \"generate sbom\", \"scan vulnerabilities\", or \"analyze dependencies\" in Copilot chat — the extension **automatically** analyzes your current project!\n\n## Example Copilot Prompts after SBOM and vulnerabilities Generation \n\nTry asking Copilot these questions:\n\n- \"Fix the above Identified vulnerabilities\"\n- \"Replace component_1 with suitable secure component\"\n\n## Requirements\n\n- VS Code 1.106 or higher\n- Access to a running SBOM MCP Server\n- Valid API key for authentication\n\n## Getting an API Key\n\n### Option 1: Free Trial (Recommended for Individual Users)\n- Start the extension and follow the trial registration prompt\n- Or run command: `SBOMApp: Start Free Trial`\n- **Trial includes**: 90 days, 100 Tokens\n\n### Option 2: Purchase Pro License\n- Visit **https://payment.sbomapp.com** or **https://sbomapp.com** to purchase\n- Get Tokens and advanced features\n- API key delivered instantly via email\n\n### Option 3: Enterprise License\n- Contact your SBOM MCP Server administrator\n- Email: **sbomappsupport@iarminfo.com**\n\n## Troubleshooting\n\n### Connection Failed\n- Verify the server URL is correct (should end with `/mcp`)\n- Check that the server is running and accessible\n- Ensure your API key is valid and not expired\n- Check if firewall allows the connection\n\n### Tools Not Working\n- Make sure the connection is established (green ✓ in status bar)\n- Check VS Code MCP settings are configured correctly\n- Try disconnecting and reconnecting\n- Restart VS Code if issues persist\n\n### Status Bar Not Showing\n- Check that `sbomRemoteMcp.showStatusBar` is enabled in settings\n- Try reloading VS Code (`Ctrl+Shift+P` → \"Reload Window\")\n\n### Check Token Usage Status\n- Click on the status bar \"SBOM MCP\" → Select \"Check token Usage\"\n- View detailed usage statistics in the output panel\n\n### Check Trial Status\n- Click on the status bar \"SBOM MCP\" → Select \"Check Trial Status\"\n- View remaining tokens, days left, and upgrade options\n- Status bar shows trial info: `✓ SBOM MCP [Trial: 450]`\n\n### Trial Expired or Tokens Exhausted\n- Status bar shows: ` SBOM MCP [Trial Expired]`\n- Click \"Upgrade Now\" in the popup to purchase Pro license\n- Or run command: `SBOMApp: Configure Remote Server` to enter a new API key\n- Upgrade at: **https://payment.sbomapp.com** or **https://sbomapp.com**\n\n### Authentication Errors\n- Verify your API key is correct\n- Ensure the API key has proper permissions\n- Contact your administrator if the key was recently rotated\n\n## Privacy & Security\n\n- API keys are stored in VS Code's secure storage\n- All communication uses HTTPS (when configured)\n- No data is sent to third parties\n- Credentials are never logged or exported\n\n\n## Support\n\n- 📧 Email: sbomappsupport@iarminfo.com\n",
  "bytes": 9083,
  "sha": "4671ee7b819858d0fb8359da69b351a726b3425305b884d651f7effea303f2d0",
  "repo_slug": "mcpsbom/sbomapp-mcp-server",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_mcpsbom_sbom_mcp_3784fca8/readme"
}