Supply chain security, simplified.
boring.tools generates SBOMs from your projects and tracks CVEs across your dependencies — so you always know what's in your software.
Built on open standards
- CycloneDX 1.5
- SPDX 2.3
- NTIA-compliant
- OSV.dev
- NVD / NIST
- EU CRA-ready
Live vulnerability tracking
Know your exposure.
boring.tools matches your SBOM against the NVD and OSV databases and surfaces every CVE that affects your dependencies — sorted by risk, deduplicated, and ready to triage.
The problem
You're shipping blind.
Most teams have no real inventory of their dependencies — until a CVE hits the news and the scramble begins.
Invisible vulnerabilities
CVEs in your dependencies go undetected for months. By the time you find out, you're already exposed.
No SBOM standard
Customers and regulators demand SBOMs. Generating them manually from your projects is error-prone and slow.
Fragmented tooling
Scanner A, tracker B, dashboard C — stitched together with scripts. One place that shows the full picture doesn't exist.
How it works
Three steps. Then it gets boring.
That's the goal: supply chain security that runs in the background and just works. No daily dashboards to babysit. No firefighting.
- 01
Connect your project
Point boring.tools at your repository or upload a manifest. We support npm, Go, Python, Rust, Java and more.
- 02
We generate the SBOM
Every build produces a CycloneDX and SPDX SBOM — versioned, signed, ready to share with customers and regulators.
- 03
Stay ahead of CVEs
We continuously match your SBOMs against NVD and OSV. Critical CVE in your stack? You'll know in minutes, not months.
Features
Everything you need.
Nothing you don't.
Read the platform overview for a deeper look at how boring.tools handles inventory, SBOMs, CVEs, and cross-project visibility.
Explore the platformSBOM Generation
Automatically generate CycloneDX and SPDX SBOMs from your project dependencies. Export, share, and store them with every release.
CVE Tracking & Alerts
Continuous CVE monitoring against the NVD and OSV databases. Get alerted the moment a new vulnerability affects your stack.
Dependency Inventory
A complete, up-to-date inventory of every package and version across all your projects. No more guessing what's in your software.
Supply Chain Dashboard
One view across all your projects. Risk scores, CVE trends, and SBOM compliance status — at a glance.
Comparison
SBOM-first, by design.
Most "security" tools bolt SBOMs on as an export feature. We built the platform around them — that's what makes the difference when regulators and customers come asking.
| Feature | boring.tools | Snyk | Dependabot | DIY scripts |
|---|---|---|---|---|
| Generates SBOM (CycloneDX + SPDX) | weeks | |||
| Continuous CVE monitoring | manual | |||
| Multi-project portfolio view | ||||
| NTIA-compliant export | maybe | |||
| Cross-ecosystem (npm + Go + Py) | maybe | |||
| Boring, calm UI | — | |||
| Self-host option | planned |
FAQ
Things people ask.
Is boring.tools production-ready?
We're currently in private beta. Early users are already running their first scans. We're targeting a public release once the SBOM-generation pipeline and CVE-correlation engine have stabilised across the major ecosystems we support.
Which package ecosystems do you support?
Day one: npm, Go modules, PyPI, Cargo and Maven. Container scanning (OCI manifests + base images) is on the roadmap and tracked in our public changelog.
Where do CVE data and advisories come from?
We aggregate the NVD (NIST), OSV.dev, GitHub Security Advisories and the relevant ecosystem advisories. Sources are clearly labelled per CVE so you can trace every finding back to its origin.
How is this different from Snyk or Dependabot?
Dependabot bumps versions, Snyk scans for issues. Neither produces compliant SBOMs you can ship with your software. boring.tools is built around the SBOM as the source of truth — vulnerability tracking, audit trails and compliance reporting fall out of that automatically.
Will there be a self-hosted version?
Yes. Self-hosting is a first-class goal — the core engine is open-source-friendly and we'll ship a Docker Compose distribution for teams that need to keep SBOMs on their own infrastructure.
How much will it cost?
Free for open source projects and individual developers, forever. Team and Enterprise tiers will be priced per project / per seat — but the beta is free for everyone who signs up now.
Got another question? Email us.
Early access
Be on the list when we launch.
Beta access is free. No credit card, no spam — just an email when we're ready for you, and occasional development updates if you want them.
- Free during beta
- No credit card
- Unsubscribe any time