Parlay Integration Guide

Enrich CycloneDX SBOMs with vulnerability data from Snyk and package metadata from ecosyste.ms using Parlay, then upload the enriched SBOM to Vulnetix.

Install & scan

$ go install github.com/snyk/parlay@latest

# or download binary from GitHub releases:
# https://github.com/snyk/parlay/releases/latest
$ cat bom.json | parlay ecosystems enrich - | parlay snyk enrich - | jq '.' > enriched-bom.json

Run Parlay in CI

Scan on every push and upload the report as a workflow artifact:

- name: Install Parlay
  run: go install github.com/snyk/parlay@latest

- name: Enrich SBOM
  env:
    SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
  run: cat bom.json | parlay ecosystems enrich - | parlay snyk enrich - > enriched-bom.json

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: parlay
    path: enriched-bom.json
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Parlay's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Parlay. Keep running it. Vulnetix sits on top of Parlay (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Parlay is strongest at its core category and also carries features in SCA, License Compliance, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Parlay does well

• Clean Unix-filter design: reads a CycloneDX or SPDX SBOM on stdin, enriches it, writes to stdout, trivial to drop into any pipeline or CI stage
• Pulls package health/metadata from ecosyste.ms (maintainers, repo links, first/latest release dates) across many ecosystems, adding provenance context most scanners omit
• Enriches components with Snyk vulnerability data including CVE/CWE, CVSS scores and advisory links when a Snyk token is supplied
• Adds OpenSSF Scorecard security-posture references to SBOM components, a lightweight way to flag risky projects

Where Vulnetix adds to it: Parlay is a one-shot enrichment filter that decorates an SBOM with third-party metadata; it has no dedup, prioritisation, VEX, or remediation. Vulnetix generates the SBOM (CycloneDX 1.7 + SPDX 2.3) natively, then layers cross-scanner dedup, exploit-intel prioritisation (EPSS/KEV/ESS/LEV), reachability, versioned VEX, and Safe Harbour autofix on top, so Parlay-style enrichment becomes one input rather than the whole story.

No migration, no rip-and-replace. Parlay keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Parlay results in Vulnetix

Upload Parlay CycloneDX, SPDX output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Parlay documentation ↗  ·  Source repository ↗

Wire Parlay into your CI/CD pipeline →