QFinch produces CycloneDX and SPDX artifacts for supported repository and container scans, retaining component identity, versions, relationships and generation provenance.
Inventory capabilities
- Direct and transitive relationships where supported by the source graph.
- Separate quality dimensions for identity, versions, ecosystems, relationships, licenses and conversion.
- History and links back to the governed asset and scan.
- Standards-based artifacts for engineering and risk workflows.
SBOM completeness depends on the source manifests, ecosystem tooling and available license evidence. QFinch reports these limitations rather than treating every generated document as equally complete.
CTA: Explore SBOM inventory