Startup-SBOM

What runs at boot, what it is made of, and how it can be attacked.

Read the documentation →

Startup-SBOM statically analyses a Linux root filesystem, container or image and answers three questions most SBOM tools can't:

1. Vulnerability → threat. Not "openssl has 14 CVEs", but "an unauthenticated remote attacker who can reach TCP/22 could exploit CVE-2024-6387 in openssh-server (sshd, ssh.service, enabled at boot, runs as root) to execute code as root — EPSS 0.94, known exploited. Fix: upgrade to 1:9.2p1-2+deb12u3." Every finding is placed in context: is it reachable at boot, through which service, linked by which binary, what triggers it (boot, socket, timer, cron, D-Bus, udev device event, setuid binary, kernel) and who can fire that trigger, as which user, network-exposed, mitigated by which systemd hardening, mapped to MITRE ATT&CK, with a CISA SSVC decision (Track / Track* / Attend / Act).
2. Chained attacks. A privilege-state attack graph (remote → local:<user> → root → container escape → persistence) built from vulnerabilities and misconfigurations (setuid/capability binaries, privileged containers, mounted Docker socket, kernel CVEs, writable units), pruned by hardening and ranked by likelihood × impact.
3. Supply-chain blast radius. A vendor → source package → binary package → file → service graph built from real code-loading edges (ELF DT_NEEDED, .note.dlopen, ld.so.preload, interpreters). It catches the xz → liblzma → libsystemd → sshd class of problem, which package dependencies alone miss. It also flags provenance risks: third-party repositories, unsigned or locally built packages, unmanaged binaries, modified files and EOL distributions.

It is read-only by design: nothing in the target is mounted, extracted or modified, symlinks can never escape the analysed root, and in the default static mode nothing in the target is executed. The opt-in chroot mode (--mode chroot) runs a few of the target's own tools to confirm the static results, only inside an unprivileged, read-only, network-less bubblewrap sandbox.

Install

uv tool install startup-sbom        # or: pipx install startup-sbom
uvx startup-sbom --help             # run without installing
docker run --rm ghcr.io/morpheuslord/startup-sbom --help

The core scanner has no heavy dependencies; optional features are extras:

Extra	Adds
startup-sbom[tui]	Interactive terminal UI (startup-sbom tui)
startup-sbom[pdf]	PDF reports (-f pdf, Typst; PDF/A-3u + PDF/UA-1 by default)
startup-sbom[ai]	AI analysis across multiple LLM providers, DuckDuckGo search, MCP server
startup-sbom[agents-server]	A2A and ACP agent servers
startup-sbom[all]	Everything above

uv tool install "startup-sbom[all]"

From source:

git clone https://github.com/morpheuslord/Startup-SBOM && cd Startup-SBOM
uv sync
uv run startup-sbom --help

Python ≥ 3.11 on Linux, macOS or Windows. Everything except host: mode and live container acquisition is pure Python and host-OS independent.

Usage

# A mounted disk or extracted rootfs
startup-sbom scan dir:/mnt/target_root -f html -f cyclonedx -o out/

# A running or stopped container (docker / podman / nerdctl)
startup-sbom scan docker:web -f json -f sarif

# Images without a container engine
startup-sbom scan docker-archive:./image.tar      # docker/podman save
startup-sbom scan oci-dir:./layout                 # OCI image layout
startup-sbom scan tar:./rootfs.tar.zst             # docker export / rootfs tarball

# The machine you are on (Linux)
sudo startup-sbom scan host: -f markdown

# CI gate: fail when anything warrants immediate action
startup-sbom scan oci-archive:img.tar -f sarif --fail-on act

# Confirm with the target's own tools in a sandbox (needs bubblewrap), keep a journal
startup-sbom scan dir:/mnt/target_root --mode chroot --journal scan.jsonl -f html

Option	Meaning
-f, --format	json, cyclonedx, spdx, sarif, openvex, cdx-vex, markdown, html, dot, mermaid, pdf (repeatable)
-o, --output	Output directory (default ./startup-sbom-out), or - to stream one format to stdout
--offline	No network; use cached intelligence only
--sources	Vulnerability sources: osv, arch, nvd (opt-in, set NVD_API_KEY), or none
--no-epss, --no-kev, --no-eol	Skip exploit-prediction, known-exploited and end-of-life enrichment
--no-language-packages	Skip Python/npm/Go/Java/Rust inventory
--no-link-analysis	Skip ELF library reachability
--integrity	Verify installed files against package-database digests
--boot-timing FILE	systemd-analyze plot SVG or blame output captured on the target
--mode	static (default, reads files only), chroot (also run the target's loader, systemctl and package manager in a bubblewrap sandbox) or auto (chroot when possible)
--no-derivative-fallback	Don't match rolling Debian derivatives (Kali, …) against Debian testing advisories
--no-cvss-impact-gate	Let confidentiality-only (I:N/A:N) flaws count as code execution
--platform	Select a platform from a multi-arch image, e.g. linux/arm64
--cdx-spec	CycloneDX 1.5, 1.6 (default) or 1.7
--fail-on	low … critical (vulnerability severity) or attend / act (SSVC)
--prefetch-intel	Fetch advisories, exploit references and articles for the top findings (opt-in, online)
--live / --no-live	Live dashboard of stages, digests and raw operations on stderr (default: on a terminal)
--journal FILE	Write every stage, raw operation, digest and analyst note as JSON lines
--ai-live	An LLM comments on each stage while the scan runs (ai extra; display-only)
--ai-provider, --ai-model, --ai-budget	Live analyst provider, provider:model-id, and spending cap in USD (default 0.10)
-q, -v, --debug	Quiet / verbose / debug

Other commands: startup-sbom tui (interactive UI), startup-sbom ai … (AI analysis and agent servers), startup-sbom intel … (CVE intelligence lookup), startup-sbom db update|status|clear (cache KEV/EPSS for offline use), startup-sbom schema (JSON Schema of the native report), startup-sbom version.

Exit codes: 0 success, 1 --fail-on threshold reached, 2 usage or target error, 3 internal error.

Outputs