EmbedHarbor
Sign InValidate an SBOM

Free SBOM Merge & Product Baseline Builder

About SBOM Merge & Baseline

Assemble module inventories into an exportable product snapshot.

Processing and Privacy

Explicit upload to EmbedHarbor · temporary processing · no account required

Free tool: results are indicative and are not a certification. Use is subject to the Terms of service and the Privacy policy.

Limits you should know

  • 5 MB per file · 20 MB per request including upload framing
  • 20,000 total components · JSON depth 64
  • 2–20 CycloneDX JSON inputs; output CycloneDX 1.6 JSON
  • Each input needs metadata.component
  • SPDX, mixed formats, nested components, VEX/vulnerabilities, signatures, services and unsupported fields require review
  • Upstream deduplication may require review even for repeated same-version components

What this result does not prove

Technical document analysis only. No signatures, supplier authenticity, legal compliance or current vulnerability exposure are verified.

How data is handled

What is the SBOM Merge & Baseline?

For firmware and product teams collecting multiple module or supplier inventories into one release baseline.

A downloadable baseline passed the supported retention checks. Needs Review withholds the baseline when assembly could lose assertions or relationships. Source metadata is carried in provenance properties.

Supported formats and limits

Accepted inputCycloneDX JSON 1.4, 1.5, 1.6
Enforced limits5 MB per file · 20 MB per request including upload framing · 20,000 total components · JSON depth 64 · 2–20 CycloneDX JSON inputs; output CycloneDX 1.6 JSON · Each input needs metadata.component · SPDX, mixed formats, nested components, VEX/vulnerabilities, signatures, services and unsupported fields require review · Upstream deduplication may require review even for repeated same-version components
ProcessingExplicit upload to EmbedHarbor · temporary processing · no account required
Not includedTechnical document analysis only. No signatures, supplier authenticity, legal compliance or current vulnerability exposure are verified.

How it works

  1. Choose inputs. Select JSON SBOMs or download the synthetic examples. Review the file limits and upload notice.
  2. Upload & Analyze. The existing EmbedHarbor API validates the request and runs the internal offline analysis engine.
  3. Review the result. A downloadable baseline passed the supported retention checks. Needs Review withholds the baseline when assembly could lose assertions or relationships. Source metadata is carried in provenance properties.
  4. Download your report. Keep the report and engine versions with the delivery. Processing does not create a SaaS product or version.

What it checks

  • Every input schema and local dependency reference
  • Different component versions and supplier assertions
  • Actual sbomasm assembly with postflight component and relationship retention checks
  • Final CycloneDX 1.6 schema and provenance properties

Common errors and fixes

The file is not supported

Use a supported JSON SBOM version; archives, XML and tag-value files are rejected.

Analysis is unavailable or timed out

Retry later or reduce the input size. A failed analysis is never displayed as a clean result.

The result needs review

Inspect the structured findings. An unevaluated check does not mean it passed.

Example output

The result is a structured report. This is the shape of the output you can export; the example reports show the full engine output for a synthetic firmware SBOM.

engine: sbomasm + sbom-utility
summary: baselineAvailable, inputFiles, components, sources
mergedSbom: present only after successful postflight checks

Privacy and data handling

Clicking Upload & Analyze sends the selected SBOMs to EmbedHarbor for this request. Temporary files are deleted after processing; reports remain in your browser until you leave. No third-party analysis service receives the files. Do not upload secrets.

Frequently asked questions

Does this save a product version in EmbedHarbor?

No. Baseline means the file you download. Long-term product-version storage and delivery tracking are available through the Early Access contact flow.

Are files sent to third-party analysis platforms?

No. Analysis runs within EmbedHarbor using bundled open-source engines and schemas. External SBOM links are not fetched.

Where this fits in the product workflow

The free tools answer one question at a time. EmbedHarbor is building the connected workflow around them — product versions, supplier components and release evidence. Product-version storage and monitoring are Early Access, not generally available.

Explore the product workflowContact us about Early Access

Next, if it is useful

Assemble module inventories into an exportable product snapshot.

CycloneDX JSON 1.4, 1.5, 1.6

Choose 2–20 module SBOMs

JSON only · 5 MB per file · 20 MB total · 20,000 total components

Synthetic samples: Module A · Module B · Module A next version

Choose files, review the upload notice, then run analysis.