Free tool · no account needed

SBOM check for ESP-IDF firmware

See what your ESP-IDF firmware's SBOM actually says: every component, its version and the identifiers vulnerability feeds look for.

Drop the files your build wrote. The check lists each component with its version, its or , and what the file left out.

For ESP-IDF, drop the SPDX or CycloneDX file that esp-idf-sbom writes for your project.

The check also scores the file against , field by field, and names which components are missing each one.

Your files are read here, in this browser tab, by a background worker, and are never uploaded. Nothing from them is sent unless you press the vulnerability check button further down, and then only the list of component names, versions and identifiers. The bot check that protects that button is run by Cloudflare and loads from Cloudflare when the vulnerability section appears, so, like any site that loads a script, Cloudflare sees your IP address from that moment. The page says what goes when you press the button.

The check tells you what the file declares and what it leaves out. It does not tell you whether a component is reachable when your firmware runs, it does not review the licence terms of your components (it only notes when a licence is missing from the file), and it does not decide whether your product is in scope of the CRA; the scope check is for that.

Drop your build's SBOM files here, or click to choose

SPDX 3.0.1 (JSON-LD), SPDX 2.2 and 2.3 (JSON), CycloneDX 1.4 to 1.6 (JSON), CycloneDX 1.1 to 1.6 (XML), SPDX 2.2 and 2.3 (tag-value), Buildroot make show-info (JSON), Buildroot .config (selected packages, versions only where it states them), Arduino project (sketch, library.properties or arduino-cli library list) and PlatformIO project (platformio.ini). Up to 10 files, 25.0 MB each.

A VEX file may go in with them — OpenVEX or CycloneDX. What it already decided is shown beside the matches, for you to read.

No SBOM yet? This loads a sample set of Zephyr build files for an ESP32 MQTT sensor. The module names and file paths are real; we assembled the set, so it is not the output of one real build.

Zephyr: west spdx --init -d build before the build, then west spdx -d build after it
ESP-IDF: esp-idf-sbom create --output-file sbom.spdx build/project_description.json
Yocto: INHERIT += "create-spdx"
Buildroot: make show-info > output/show-info.json

Reading the current legal state…

What happens to your data

Your files are read in this browser tab. They are not uploaded.
If you press Check, only component names, versions and identifiers (PURL, CPE) are sent to our lookup service. We reuse the answer for 24 hours under a one-way hash of that list so a repeat check is quick; no IP address or account is stored with it. To stop abuse we also count checks per visitor under a separate one-way hash of your IP address.
Cloudflare Turnstile checks that a person pressed the button. Like any site you load, Cloudflare sees your IP address.
Your file itself is never sent to or stored on our servers. The component list you send when you press Check is kept only as the 24-hour answer described above, and nothing is tied to you until you save the product to an account.

Declarable prepares documentation for you to review. It is not legal advice and not certification. You sign your own declaration of conformity.