SBOM tools for firmware, compared

An SBOM is the list of software parts in your product. Most build tools write one; fewer read it back and match it to known vulnerabilities. This page shows what each tool says it does on the page we read, including the chip makers’ device clouds, nRF Cloud and Memfault. What Declarable adds is a dated record: an Annex I checklist showing what is still open, a place to record your decision on each vulnerability match, and document drafts stamped with the template and legal-state version they were prepared under.

Newest check: 13 October 2026

When another option is the better choice

Our judgement, not a finding from the sources below.

west spdx (Zephyr): You build with Zephyr and only need the SBOM file itself, written from your build.
esp-idf-sbom (Espressif): You build with ESP-IDF and want an SBOM with identifiers and a vulnerability check from one open-source command. What Declarable adds is the CRA record: an Annex I checklist showing what is still open, a place to record your decision on each vulnerability match, and document drafts stamped with the template and legal-state version they were prepared under.
nRF Cloud (Nordic): You want your chip maker’s cloud for the devices already in the field. We read only its introduction page, so ask Nordic what its vulnerability features cover before you decide.
Memfault: You want a device-fleet service that stores an SBOM for each software version and scans it for known vulnerabilities, and you are happy to keep your own record of decisions separately.
sbom-cve-check (Bootlin): You build with Yocto and want an open-source command that matches an SPDX SBOM against NVD and the CVE List.
Dependency-Track (OWASP): You already run a Dependency-Track server and want CycloneDX SBOMs analysed there. Declarable does not export to it; our CI guides show how to upload our files yourself.
CRAVEX (AboutCode): You want an open-source base you run yourself for SBOMs, vulnerability matching and VEX files. Its page does not mention Article 14 reports or a declaration, so those stay your own work.
Syft (Anchore): You ship a container image or a filesystem rather than bare-metal firmware.

SBOM tools for firmware, compared
Criterion	Declarable SBOM check	west spdx (Zephyr)	Yocto create-spdx	esp-idf-sbom (Espressif)	Syft (Anchore)	nRF Cloud (Nordic)	Memfault	sbom-cve-check (Bootlin)	Dependency-Track (OWASP)	CRAVEX (AboutCode)
Input it reads — What you point the tool at: a build directory, a project, a container image or an existing SBOM file	An SBOM file you already have (SPDX or CycloneDX).	A built Zephyr application with CONFIG_BUILD_OUTPUT_META enabledsource, 7 October 2026	Not checked^*	project_description.json from an ESP-IDF build, plus sbom.yml manifestssource, 7 October 2026	Container images, filesystems and archivessource, 7 October 2026	Not mentioned on the introduction page, which covers device management, updates, observability and locationsource, 11 October 2026	SBOM files you upload, stored for each software version: “JSON, XML, SPDX, or YAML”. By default the file is checked to be well-formed, not parsedsource, 11 October 2026	SPDX 2.2 and SPDX 3 SBOMs; CycloneDX is listed as planned. Designed to fit the Yocto Projectsource, 11 October 2026	CycloneDX SBOMs, uploaded through the REST API, CI plugins or the web interfacesource, 11 October 2026	SBOMs you import in CycloneDX (1.4 to 1.6) or SPDX 2.3, and scan data from ScanCode.io. The page does not name firmware build outputssource, 13 October 2026
Output format — SPDX and CycloneDX are the two common SBOM file formats	A report on what the SBOM lacks. It does not write a new SBOM.	SPDX 2.x tag-value, or SPDX 3.0 JSON-LDsource, 7 October 2026	SPDX in JSON, one IMAGE-MACHINE.spdx.json filesource, 7 October 2026	SPDX (tag/value, JSON, JSON-LD 3.0) and CycloneDX JSONsource, 7 October 2026	CycloneDX, SPDX and Syft JSONsource, 7 October 2026	Not mentioned on the introduction pagesource, 11 October 2026	Not mentioned on the pagesource, 11 October 2026	Exports including SPDX 3.0 and a Yocto cve-check manifest; OpenVEX is on the roadmapsource, 11 October 2026	Findings sent on by webhook, chat and email; the page names no SBOM output formatsource, 11 October 2026	CycloneDX 1.4 to 1.6 and SPDX 2.3; VEX in CSAF, CycloneDX or OpenVEX, or a combined SBOM and VEX document in CycloneDXsource, 13 October 2026
Writes PURL/CPE for C libraries — PURL and CPE are identifiers that let a vulnerability database recognise a part	Reads the identifiers in your SBOM and reports which parts have none.	Not mentioned on the pagesource, 7 October 2026	Not checked^*	Writes PURLs and supports CPE valuessource, 7 October 2026	Not detailed on the pagesource, 7 October 2026	Not checked^*	Not mentioned on the pagesource, 11 October 2026	Not mentioned on the pagesource, 11 October 2026	Not mentioned on the pagesource, 11 October 2026	PURL is the primary identifier; CPE is not mentioned on the pagesource, 13 October 2026
Finds Kconfig-enabled subsystems — Kconfig switches decide which parts of an embedded OS are compiled into your firmware	Yes, for Zephyr. Add the build’s .config beside your SBOM and the check lists the subsystems switched on there, such as Bluetooth, MQTT, the IP stack and USB. It reads your build files and your SBOM, not a finished firmware binary.	Not checked^*	Not checked^*	Not checked^*	Not checked^*	Not checked^*	Not checked^*	Not mentioned. It does say a CVE is treated as not applicable when the affected source file is not compiled insource, 11 October 2026	Not mentioned on the pagesource, 11 October 2026	Not mentioned on the pagesource, 13 October 2026
Matches vulnerabilities — Compares the listed parts with known vulnerability records	Matches components against known vulnerability records for saved products.	Not part of the command; the page points to a separate vulnerability-monitoring sectionsource, 7 October 2026	Not checked^*	A check command scans SBOMs against the National Vulnerability Databasesource, 7 October 2026	Left to a separate scanner, Grypesource, 7 October 2026	Vulnerability scanning and SBOMs are not mentioned on the introduction page. We did not find a dedicated page; this does not mean the service lacks itsource, 11 October 2026	With CVE scanning enabled, SPDX SBOMs are parsed for their components (SPDX 2.2 and 2.3, and 3.x in JSON-LD) and scanned against known vulnerabilitiessource, 11 October 2026	Yes: NVD and the CVE Listsource, 11 October 2026	Yes: NVD, Sonatype OSS Index, GitHub Advisories, Snyk and OSVsource, 11 October 2026	Through an integration with VulnerableCode; the page names no other databasesource, 13 October 2026
Licence — The licence the tool itself is released under	A hosted service, not a downloadable tool.	Not checked^*	Not checked^*	Not checked^*	Apache-2.0source, 7 October 2026	Not checked^*	Not checked^*	Open source, GPLv2source, 11 October 2026	Described as free and open sourcesource, 11 October 2026	DejaCode, the application CRAVEX runs in, is AGPL-3.0-only. The CRAVEX page itself states no licence for the softwaresource, 13 October 2026
Price — What the vendor’s own page says it costs	The check is free. Plans and prices are on /pricing.	Not checked^*	Not checked^*	Not checked^*	Not checked^*	Not checked^*	Not checked^*	Not checked^*	Not checked^*	Not stated. The page offers a free DejaCode trial account and gives no price for continued usesource, 13 October 2026

* We have not verified this; it does not mean the product lacks it.

How we checked

A cell about another product is filled in only from a page we opened and read; it links to that page and shows the date we read it. Cells older than 90 days say so.
Anything else reads “Not checked”. We have not verified it, and it does not mean the product lacks it.
Declarable’s current prices are on the pricing page.
If a cell about your product is wrong, tell us through the About page and we will correct it with a new date.

Want to see what your own SBOM is missing?

Check an SBOM

Keep reading

Declarable prepares documentation for you to review. It is not legal advice and not certification. You sign your own declaration of conformity.