Am I affected? SBOM scan

Drop a manifest or lockfile here, or click to browse

11 ecosystems, plus CycloneDX and SPDX SBOMs: see the list below

or paste it manually

Supported files · 11 ecosystems, plus CycloneDX and SPDX SBOMs

Language	Ecosystem	Files
JavaScript / Node	npm	`package-lock.json` · `package.json` · `yarn.lock` · `pnpm-lock.yaml`
Python	PyPI	`requirements.txt` · `poetry.lock` · `Pipfile.lock`
Rust	crates.io	`Cargo.lock`
Go	Go	`go.mod` · `go.sum`
Java / Kotlin	Maven	`pom.xml` · `gradle.lockfile`
PHP	Packagist	`composer.lock`
Ruby	RubyGems	`Gemfile.lock`
.NET / C#	NuGet	`packages.lock.json`
Dart / Flutter	Pub	`pubspec.lock`
Elixir / Erlang	Hex	`mix.lock`
Dev tools (partial)	mise	`mise.lock`: only `npm:` / `pipx:` / `cargo:` / `gem:` / `go:` / `dotnet:` backends; runtimes pinned via `core:`, `aqua:`, `ubi:` or `asdf:` are reported as skipped
Any language		CycloneDX (JSON or XML) and SPDX (JSON or tag-value) SBOMs, via purl, OS packages (Debian, Ubuntu, Alpine) included

Lockfiles give exact (pinned) versions: the most accurate results. Manifests with version ranges (package.json, pom.xml, unpinned requirements.txt) are resolved best-effort and flagged as approximate.

No manifest scanned yet

Drop a lockfile or SBOM to check your dependencies

Integrations

Run it where you already work

No need to come back here to scan. The same scanner runs in your editor, in CI before a merge, and in your AI assistant, against the same OSV and NVD data.

VS Code

and Cursor, Windsurf, VSCodium

Rescans a lockfile when its contents change: findings in the Problems panel, CVE details on hover, EPSS and KEV status.

VS Marketplace Open VSX

JetBrains IDEs

IntelliJ, PyCharm, GoLand, WebStorm, RustRover

Findings inline in the lockfile and in the mlab tool window, rescanned when the lockfile changes.

JetBrains Marketplace

GitHub Action

every push and pull request

Writes a job summary and fails the build above the severity you choose.

uses: mlab-sh/vuln-scan-action@v1

GitHub Marketplace

mlab CLI

terminal and pre-commit

Scan a lockfile from the terminal, or block a commit that brings in a high or critical vulnerability.

- id: mlab-sbom-scan

GitHub

Claude Code

plugin

/mlab:sbom-audit scans a lockfile, ranks findings by KEV and EPSS and names the actors exploiting them.

/plugin install mlab@mlab-sh

GitHub

MCP server

any MCP client

The scan_sbom tool, for Claude, Cursor or your own agent.

https://mlab.sh/mcp

GitHub

With a vuln.mlab.sh API token, the editor plugins and the GitHub Action scan with your plan's limits (1024 packages per scan on Free, 4096 with no cooldown on paid plans) and their scans land in your scan history.