Open Source

SBOM Generation. Free. For Everyone.

kunnus-scanner is an open source CLI tool that scans source code, operating systems, firmware images, and container images and generates a standards-compliant Software Bill of Materials in minutes.

View on GitHubDocumentationExplore the Full Platform
OpenSSF Best Practices badge: passing — view the reportOpenSSF Scorecard badge — view the current score

Built for CRA Compliance. Free to Use.

The EU Cyber Resilience Act requires manufacturers to maintain an SBOM for every product they ship. We believe the tooling to generate those SBOMs should be freely available to everyone – from solo developers to large engineering teams.

Manufacturers shall identify and document vulnerabilities and components contained in products, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at least the top-level dependencies of the products.

— Regulation (EU) 2024/2847, Annex I, Part II

What kunnus-scanner Does

Code, OS & Container Scans

Scan a source repository, a running machine or mounted firmware image, or a container image with per-layer attribution — one binary, three commands.

CycloneDX 1.6

Outputs standard-compliant CycloneDX 1.6, conformant with BSI TR-03183-2 – including licences, content hashes, and CPEs where derivable.

Offline by Default

Scans make no network requests. Run it from a USB stick on an air-gapped industrial PC – no installer, no cloud connection, no account.

CI/CD Integration

The Docker image drops into GitHub Actions, GitLab CI, or Jenkins. Exit codes distinguish clean scans from degraded ones, so your pipeline can tell a complete SBOM from one with gaps.

Broad Ecosystem Coverage

npm, Python, Go, Rust, Java, .NET, PHP, Ruby, and more via Google's osv-scalibr – plus native support for embedded firmware manifests (vcpkg, CMake, Zephyr, PlatformIO, ESP-IDF, Arduino, CMSIS, ModusToolbox) and OS packages on Linux, Windows, and macOS.

Multiple Install Paths

Homebrew (macOS), Scoop (Windows), .deb/.rpm packages, Docker (amd64/arm64), or pre-built binaries. Releases ship with SLSA Build L3 provenance and signed container images.

Get Started in Minutes

01Install
brew install think-ahead-technologies/tap/kunnus

Also available via Scoop, Docker, .deb/.rpm packages, and pre-built binaries.

02Scan a repository
kunnus sbom repo --output sbom.cdx.json

Auto-detects every ecosystem in the tree and writes a CycloneDX 1.6 SBOM.

03Scan a machine or image
kunnus sbom os --output machine.cdx.json

Inventories the OS you're standing on – or a mounted firmware image. kunnus sbom container <image> does the same for container images.

Read the full documentation

GitHub Actions

Add SBOM generation and upload to any workflow in two steps.

.github/workflows/sbom.yml
- name: Generate SBOM
  run: |
    docker run --rm -v ${{ github.workspace }}:/src \
      ghcr.io/think-ahead-technologies/kunnus-scanner:latest \
      sbom repo /src --output /src/sbom.cdx.json

- name: Upload to kunnus platform
  env:
    KUNNUS_API_KEY: ${{ secrets.KUNNUS_API_KEY }}
    KUNNUS_COMPONENT_ID: ${{ vars.KUNNUS_COMPONENT_ID }}
  run: |
    docker run --rm -v ${{ github.workspace }}:/src \
      -e KUNNUS_API_KEY -e KUNNUS_COMPONENT_ID \
      ghcr.io/think-ahead-technologies/kunnus-scanner:latest \
      upload /src/sbom.cdx.json

Need More Than SBOM Generation?

kunnus-scanner generates the SBOM. The Kunnus platform takes it from there: continuous vulnerability monitoring across all your products, automated CVE alerting, structured CRA documentation, and the audit trail you need for market surveillance authorities.

See What the Platform AddsSchedule Demo

Apache 2.0 Licensed

kunnus-scanner is free to use, modify, and distribute. Built on Google's osv-scalibr. Contributions welcome.

View Source on GitHub