Who it is forA compliance or security lead who must hand a software bill of materials to a customer or auditor.
The problemTeams need a standard inventory of components in a release, and building one by hand takes days.
The outcomeAn SBOM in CycloneDX 1.5 or SPDX 2.3 format for the project, ready to attach to a release or audit file.
What you need first
- A terminal (bash on Linux or macOS, or PowerShell on Windows), or Docker
- A project directory with dependencies to scan
- Git and make only if building from source
Steps
- Start the dashboard with
fgctl serve - Open http://localhost:8080 in a browser
- Open the Inventory section and select the project's workspace
- Choose SBOM generation and pick CycloneDX or SPDX
- Download the generated file and store it with the release record
Prompt for your agent
Using the repo Mah3Sec/ForgeGuardian, start the dashboard with `fgctl serve`, then generate a CycloneDX 1.5 SBOM for <workspace-name> from the Inventory page. Expected output is a saved SBOM file. Verify the file is valid JSON and lists the project's dependencies.
Caveat. The README does not give a CLI command for SBOM export, so this flow uses the dashboard, and the exact menu labels may differ from the README wording.
Use this in your AI agent
Ask your agent
Using the Deduped MCP, get the setup steps for Mah3Sec/ForgeGuardian and "Generate an SBOM for a project in the dashboard"
Add Deduped to Claude Code once
claude mcp add --transport http deduped https://dedupedai.com/mcp
Every Monday: the 5 hottest repos and exactly how to use them. Free, one email a week, unsubscribe anytime.
Get them freeShare: X LinkedIn Hacker News Email Copy link
Third-party repos we don't own. AI-written use cases can be wrong. Disclaimer