EmbedHarbor
Sign InValidate an SBOM

Free SBOM Quality Score Checker

About SBOM Quality Score

Measure SBOM information quality and find what needs improvement.

Processing and Privacy

Explicit upload to EmbedHarbor · temporary processing · no account required

Free tool: results are indicative and are not a certification. Use is subject to the Terms of service and the Privacy policy.

Limits you should know

  • 5 MB per file · 20 MB per request including upload framing
  • 20,000 total components · JSON depth 64
  • One file per run
  • Quality is not evaluated when the declared schema is invalid

What this result does not prove

Technical document analysis only. No signatures, supplier authenticity, legal compliance or current vulnerability exposure are verified.

How data is handled

What is the SBOM Quality Score?

For developers and OEM engineers reviewing the usefulness of a software inventory before analysis or delivery.

The score measures information quality under the displayed engine version. A high score does not establish supplier trust or delivery acceptance.

Supported formats and limits

Accepted inputCycloneDX JSON 1.4, 1.5, 1.6 · SPDX 2.3 JSON
Enforced limits5 MB per file · 20 MB per request including upload framing · 20,000 total components · JSON depth 64 · One file per run · Quality is not evaluated when the declared schema is invalid
ProcessingExplicit upload to EmbedHarbor · temporary processing · no account required
Not includedTechnical document analysis only. No signatures, supplier authenticity, legal compliance or current vulnerability exposure are verified.

How it works

  1. Choose inputs. Select JSON SBOMs or download the synthetic examples. Review the file limits and upload notice.
  2. Upload & Analyze. The existing EmbedHarbor API validates the request and runs the internal offline analysis engine.
  3. Review the result. The score measures information quality under the displayed engine version. A high score does not establish supplier trust or delivery acceptance.
  4. Download your report. Keep the report and engine versions with the delivery. Processing does not create a SaaS product or version.

What it checks

  • Declared schema through sbom-utility
  • Real sbomqs score from 0–10 and versioned scoring dimensions
  • Evaluated and unevaluated dimensions, with improvement recommendations

Common errors and fixes

The file is not supported

Use a supported JSON SBOM version; archives, XML and tag-value files are rejected.

Analysis is unavailable or timed out

Retry later or reduce the input size. A failed analysis is never displayed as a clean result.

The result needs review

Inspect the structured findings. An unevaluated check does not mean it passed.

Example output

The report includes a quality score and its dimensions. This is the shape of the output you can export; the example reports show the full engine output for a synthetic firmware SBOM.

engine: sbomqs + sbom-utility
summary: score, schemaValid
metrics: dimensions, qualityRuleVersion
findings: severity, category, recommendation

Privacy and data handling

Clicking Upload & Analyze sends the selected SBOMs to EmbedHarbor for this request. Temporary files are deleted after processing; reports remain in your browser until you leave. No third-party analysis service receives the files. Do not upload secrets.

Frequently asked questions

Why is a dimension marked not evaluated?

The scoring engine can exclude dimensions that it cannot evaluate. These are listed explicitly and are never displayed as passed.

Are files sent to third-party analysis platforms?

No. Analysis runs within EmbedHarbor using bundled open-source engines and schemas. External SBOM links are not fetched.

Where this fits in the product workflow

The free tools answer one question at a time. EmbedHarbor is building the connected workflow around them — product versions, supplier components and release evidence. Product-version storage and monitoring are Early Access, not generally available.

Explore the product workflowContact us about Early Access

Next, if it is useful

Measure SBOM information quality and find what needs improvement.

CycloneDX JSON 1.4, 1.5, 1.6 · SPDX 2.3 JSON

Choose an SBOM

JSON only · 5 MB per file · 20 MB total · 20,000 total components

Download sample SBOM Try the tool with sample data before uploading your own SBOM. Artificially constructed demo data.

Choose files, review the upload notice, then run analysis.

More sbomqs Tools

sbomqs Workbench

About sbomqs Commands

These controls invoke the pinned upstream command implementation. Standard evaluations and policies are technical document checks, not certification. Original output is preserved for download. Background details remain here; upload and publication decisions are shown beside their actions.

No local files selected.

5 MB per file · 20 MB total · native upstream formats. Policy, standard evaluation and sharing accept one file.

Lists use upstream feature predicates; they may differ from profile-specific scoring criteria.