CycloneDX Python Integration Guide

Integrate the CycloneDX Python tool with Vulnetix. Generate a CycloneDX SBOM from your Python project using uv or pip, then upload to Vulnetix.

Install & scan

$ # Recommended: run without global install
uv run --with cyclonedx-bom cyclonedx-py --help

# Or install globally
uv tool install cyclonedx-bom
# or: pip install cyclonedx-bom
$ uv run --with cyclonedx-bom cyclonedx-py environment --output-format JSON --output-file bom.json

Run CycloneDX Python in CI

Scan on every push and upload the report as a workflow artifact:

- name: Set up Python
  uses: actions/setup-python@v5
  with:
    python-version: '3.12'

- name: Install dependencies
  run: pip install -r requirements.txt

- name: Generate CycloneDX SBOM
  run: uv run --with cyclonedx-bom cyclonedx-py environment --output-format JSON --output-file bom.json

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: cyclonedx-python
    path: bom.json
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under CycloneDX Python's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace CycloneDX Python. Keep running it. Vulnetix sits on top of CycloneDX Python (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

CycloneDX Python is strongest at its core category and also carries features in License Compliance, SCA, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What CycloneDX Python does well

• Broad Python coverage: pip requirements.txt, Poetry and Pipenv (both manifest and lockfile) and live virtual environments natively, with PDM, uv and Conda projects captured through their virtual environments
• Self-described as one of the most accurate/complete Python SBOM generators, targeting OWASP SCVS Level-2 (only external signing missing)
• Emits CycloneDX in JSON and XML with Python-specific property taxonomies (cdx:python/pipenv/poetry) for downstream tooling
• Can inspect the actually-installed environment, so the inventory reflects what is really deployed rather than only declared ranges

Where Vulnetix adds to it: Vulnetix ingests this tool's CycloneDX SBOM and adds the missing layers: vulnerability + malware matching across the Python inventory, cross-scanner dedup, exploit-intel prioritisation (EPSS/KEV/ESS/CWSS/LEV), reachability (tree-sitter + CVEAffected), versioned VEX + audit, EOL policy, SSVC and Safe Harbour autofix, plus normalisation to CycloneDX 1.7 / SPDX 2.3. Better together, cyclonedx-python captures the Python component truth, Vulnetix turns it into a prioritised remediation queue.

No migration, no rip-and-replace. CycloneDX Python keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise CycloneDX Python results in Vulnetix

Upload CycloneDX Python CycloneDX output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

CycloneDX Python documentation ↗  ·  Source repository ↗

Wire CycloneDX Python into your CI/CD pipeline →