Automic VaultAutomic Vault

brew

Install cyclonedx-cli with Homebrew, Nix, winget

Tool for analysis and manipulation of CycloneDX SBOMs. Version 0.32.0 via Homebrew; verified 2026-06-14.

Install commandSecurity notes

install

Additional install commands

macOS

Homebrewverified · 100%
brew install cyclonedx-cli

local Homebrew formula metadata

Linux

Nixverified · 92%
nix profile install nixpkgs#cyclonedx-cli

nixpkgs package indexes · pkgs/by-name/cy/cyclonedx-cli/package.nix · source: api.github.com

Windows

Windows Package Managerverified · 92%
winget install --id CycloneDX.CLI -e

Windows Package Manager source index · CycloneDX.CLI · source: cdn.winget.microsoft.com

overview

Package summary

Tool for analysis and manipulation of CycloneDX SBOMs

Commands and aliases

  • cyclonedx

history

Project history and usage

CycloneDX CLI is the general-purpose command-line tool for analyzing, modifying, converting, diffing, merging, signing, verifying, and validating CycloneDX BOM files.

Project history

The CycloneDX standard began as an OWASP security-focused Bill of Materials format in 2018, then expanded through versions 1.1 through 1.7 into pedigree, services, composition, VEX/VDR, AI transparency, cryptographic assets, attestation, and citation support. The cyclonedx-cli repository was created in October 2020 as a dedicated automation tool around those BOM documents.

Adoption history

CycloneDX's official site describes it as an international standard, with v1.6 ratified as ECMA-424 in June 2024, and its tool center lists hundreds of supporting tools. Within that ecosystem, cyclonedx-cli fills the package-manager-friendly role of a format workbench rather than a language-specific generator.

How it is used

The CLI is commonly used after an SBOM has already been produced: converting between XML, JSON, Protobuf, CSV, and SPDX JSON, validating against schema versions, merging component BOMs, diffing releases, and signing or verifying BOM artifacts in CI pipelines.

Why package nerds care

For maintainers, cyclonedx-cli matters because it gives distributions and build systems a single executable for SBOM hygiene tasks that otherwise require language-specific libraries or custom scripts.

Timeline

  • 2018: CycloneDX v1.0 introduced a general-purpose security-focused BOM standard.
  • 2020: cyclonedx-cli repository and early releases appeared.
  • 2024: CycloneDX v1.6 was ratified as ECMA-424, 1st Edition.
  • 2025: CycloneDX v1.7 added citation, patent, and expanded transparency support.

Related projects

  • The CLI sits beside language-specific generators such as cyclonedx-gomod and cyclonedx-python, and interoperates with SPDX through its conversion command.

security posture

No protected-tool coverage found yet

No matching local secret-handling manifest was found for cyclonedx-cli. Nucleus package metadata is still published here so future coverage has a stable package URL.

Install behavior

  • No Homebrew post-install hook is recorded in formula metadata.
  • Homebrew bottle metadata is available for 6 platform targets.
  • Installs with 1 runtime dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

CommandKindExposureNote
cyclonedxcliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08
manager version0.32.0
manager updated2026-06-14
local dataok
upstreamcurrent
latest detectedv0.32.0

https://github.com/CycloneDX/cyclonedx-cli

  • okNo freshness warnings were generated.

install metadata

Package metadata

Package keybrew:cyclonedx-cli
Version0.32.0
Package managerHomebrew
Package manager pagehttps://formulae.brew.sh/formula/cyclonedx-cli
Homepagehttps://cyclonedx.org/
Repositoryhttps://github.com/CycloneDX/cyclonedx-cli
Upstream docshttps://cyclonedx.org/
LicenseApache-2.0
Source archivehttps://github.com/CycloneDX/cyclonedx-cli/archive/refs/tags/v0.32.0.tar.gz
Last updated2026-06-14T23:05:05Z
Pulseupdated
Dependenciesdotnet
Bottleavailable (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-installnot defined
Servicenone declared

registry facts

Source database details

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namecyclonedx-cli
Version Scheme0
Revision0
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Nix95%

cyclonedx-cli

nix profile install nixpkgs#cyclonedx-cli
  • normalized package name match
  • Matched by: Cyclonedx Cli
nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/cy/cyclonedx-cli/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
winget95%

CycloneDX.CLI

winget install --id CycloneDX.CLI -e
  • normalized package name match
  • Matched by: Cyclonedx Cli
Windows Package Manager source index · cdn.winget.microsoft.com · Windows Package Manager source index: CycloneDX.CLI from https://cdn.winget.microsoft.com/cache/source.msix

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Nucleus package database
  • cross-ecosystem install command graph
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment