All projects matching “sbom”

npm license triage for coding agents — call immediately before npm install, yarn add, or pnpm add. Returns npm-declared license, SPDX id, and permissive-default compatible (yes | no | unknown) so the agent can proceed, swap package, or escalate. Not SBOM, not legal advice. Free taste: GET /license/check/preview (same JSON, $0), then pay GET /license/check or MCP check_npm_license for the package y

Takes a file digest and answers which released package version it is. Useful for an artefact found in a container layer, a build directory or an attachment with no metadata attached. Hex and base64 input are both accepted and normalised, the digest length is checked against the declared algorithm before anything is fetched, and the response names every matching package version, since one artefact