Bill of materials

Inventory what's inside your software, from source-code dependencies to the packages on a running asset to your AI models, without leaving VS Code.

A bill of materials lists the components inside your software. The extension generates three kinds, and you never have to pick a tool: you choose what to inventory, and Mondoo runs the right scanner behind the scenes (xgrep for source code, cnspec for assets).

Open the Bills of Materials view in the Mondoo sidebar (the activity-bar icon) to generate one in a click, run the bill-of-materials walkthrough from the Get Started page, or use the commands below.

Where to start

The Bills of Materials view lists every generator as a one-click action:

Generate SBOM — this project: source-code SBOM of the open workspace (xgrep), skipping the scope prompt.
Generate SBOM — asset or target: installed and runtime packages on a configured target (cnspec).
Generate AIBOM: AI models on a target (cnspec).
Get Started: open the walkthrough.

The first action is also a button on the view's title bar.

Download a CycloneDX SBOM for this project

Open the Bills of Materials view and click Generate SBOM — this project (or run Mondoo Tools: Generate SBOM — This Project from the Command Palette).
Pick a format. CycloneDX (JSON) is selected by default.
Choose where to save. The default filename uses the project name and a .cdx.json extension (for example my-app-sbom.cdx.json).

The file is written and opened in the editor, ready to attach to compliance evidence, a CI artifact, or a vulnerability scanner. It runs fully offline, with no target or credentials needed.

Software bill of materials (SBOM)

Generate SBOM asks what you want an SBOM of:

Source code (this workspace): the dependencies declared in your project's manifests and lockfiles (go.mod, package-lock.json, Cargo.lock, …), produced fully offline by the bundled xgrep scanner. No target, no credentials, safe to run in any pipeline.
Asset or target: the installed and runtime packages on a configured system (local, ssh, docker), produced by cnspec against the target.

You think in terms of the scope; the extension selects the engine.

AI bill of materials (AIBOM)

Generate AIBOM inventories the AI/ML models, agents, and related assets in scope, increasingly part of what ships in a codebase or runs in your infrastructure. It runs against a target with cnspec and can surface models from local runtimes and the major cloud AI providers (aws, azure, gcp).

Output formats

Every BOM is written to a file you choose and opened for you, in a format other tools understand. SBOM offers:

Format	Extension	Use it for
CycloneDX (JSON)	`.cdx.json`	Default for most SCA and vulnerability tools
CycloneDX (XML)	`.cdx.xml`	CycloneDX consumers that expect XML
SPDX (JSON)	`.spdx.json`	SPDX-based compliance tooling
SPDX (tag-value)	`.spdx`	Classic SPDX documents
JSON	`.json`	Custom processing
Table	`.txt`	A quick human-readable list

AIBOM additionally offers Markdown (opened with a rendered preview). So a BOM drops straight into compliance evidence, CI artifacts, and vulnerability scanners.

Troubleshooting

"xgrep is not available": the source-code SBOM uses the bundled xgrep scanner. Run Mondoo Code Security: Set Up Scanner to install it, then try again.
No compatible targets: the asset/target flows need a configured scan target of a supported type. Add one with Mondoo Infrastructure Security: Add Target Configuration.

Credentials

The asset/target flows pick from your configured scan targets, so credentials are delivered the same safe way as a scan: stored in your OS keychain and passed off the command line, never in settings or shell history.