morpheuslord/startup-sbomA tool to reverse engineer and inspect the RPM and APT databases to list all the packages along with executables, service, versions and CVE.
What runs at boot, what it is made of, and how it can be attacked.
Startup-SBOM statically analyses a Linux root filesystem, container or image and answers three questions most SBOM tools can't:
ssh.service, enabled at boot, runs as root) to execute
code as root — EPSS 0.94, known exploited. Fix: upgrade to 1:9.2p1-2+deb12u3."
Every finding is placed in context: is it reachable at boot, through which service,
linked by which binary, what triggers it (boot, socket, timer, cron, D-Bus, udev
device event, setuid binary, kernel) and who can fire that trigger, as which user,
network-exposed, mitigated by which
systemd hardening, mapped to MITRE ATT&CK, with a CISA SSVC decision
(Track / Track* / Attend / Act).remote → local:<user> → root → container escape → persistence) built from
vulnerabilities and misconfigurations (setuid/capability binaries, privileged
containers, mounted Docker socket, kernel CVEs, writable units), pruned by
hardening and ranked by likelihood × impact.DT_NEEDED,
.note.dlopen, ld.so.preload, interpreters). It catches the
xz → liblzma → libsystemd → sshd class of problem, which package dependencies
alone miss. It also flags provenance risks: third-party repositories, unsigned or
locally built packages, unmanaged binaries, modified files and EOL distributions.It is read-only by design: nothing in the target is mounted, extracted or
modified, symlinks can never escape the analysed root, and in the default static
mode nothing in the target is executed. The opt-in chroot mode (--mode chroot)
runs a few of the target's own tools to confirm the static results, only inside
an unprivileged, read-only, network-less bubblewrap sandbox.
uv tool install startup-sbom # or: pipx install startup-sbom
uvx startup-sbom --help # run without installing
docker run --rm ghcr.io/morpheuslord/startup-sbom --help
The core scanner has no heavy dependencies; optional features are extras:
| Extra | Adds |
|---|---|
startup-sbom[tui] | Interactive terminal UI (startup-sbom tui) |
startup-sbom[pdf] | PDF reports (-f pdf, Typst; PDF/A-3u + PDF/UA-1 by default) |
startup-sbom[ai] | AI analysis across multiple LLM providers, DuckDuckGo search, MCP server |
startup-sbom[agents-server] | A2A and ACP agent servers |
startup-sbom[all] | Everything above |
uv tool install "startup-sbom[all]"
From source:
git clone https://github.com/morpheuslord/Startup-SBOM && cd Startup-SBOM
uv sync
uv run startup-sbom --help
Python ≥ 3.11 on Linux, macOS or Windows. Everything except host: mode and live
container acquisition is pure Python and host-OS independent.
# A mounted disk or extracted rootfs
startup-sbom scan dir:/mnt/target_root -f html -f cyclonedx -o out/
# A running or stopped container (docker / podman / nerdctl)
startup-sbom scan docker:web -f json -f sarif
# Images without a container engine
startup-sbom scan docker-archive:./image.tar # docker/podman save
startup-sbom scan oci-dir:./layout # OCI image layout
startup-sbom scan tar:./rootfs.tar.zst # docker export / rootfs tarball
# The machine you are on (Linux)
sudo startup-sbom scan host: -f markdown
# CI gate: fail when anything warrants immediate action
startup-sbom scan oci-archive:img.tar -f sarif --fail-on act
# Confirm with the target's own tools in a sandbox (needs bubblewrap), keep a journal
startup-sbom scan dir:/mnt/target_root --mode chroot --journal scan.jsonl -f html
| Option | Meaning |
|---|---|
-f, --format | json, cyclonedx, spdx, sarif, openvex, cdx-vex, markdown, html, dot, mermaid, pdf (repeatable) |
-o, --output | Output directory (default ./startup-sbom-out), or - to stream one format to stdout |
--offline | No network; use cached intelligence only |
--sources | Vulnerability sources: osv, arch, nvd (opt-in, set NVD_API_KEY), or none |
--no-epss, --no-kev, --no-eol | Skip exploit-prediction, known-exploited and end-of-life enrichment |
--no-language-packages | Skip Python/npm/Go/Java/Rust inventory |
--no-link-analysis | Skip ELF library reachability |
--integrity | Verify installed files against package-database digests |
--boot-timing FILE | systemd-analyze plot SVG or blame output captured on the target |
--mode | static (default, reads files only), chroot (also run the target's loader, systemctl and package manager in a bubblewrap sandbox) or auto (chroot when possible) |
--no-derivative-fallback | Don't match rolling Debian derivatives (Kali, …) against Debian testing advisories |
--no-cvss-impact-gate | Let confidentiality-only (I:N/A:N) flaws count as code execution |
--platform | Select a platform from a multi-arch image, e.g. linux/arm64 |
--cdx-spec | CycloneDX 1.5, 1.6 (default) or 1.7 |
--fail-on | low … critical (vulnerability severity) or attend / act (SSVC) |
--prefetch-intel | Fetch advisories, exploit references and articles for the top findings (opt-in, online) |
--live / --no-live | Live dashboard of stages, digests and raw operations on stderr (default: on a terminal) |
--journal FILE | Write every stage, raw operation, digest and analyst note as JSON lines |
--ai-live | An LLM comments on each stage while the scan runs (ai extra; display-only) |
--ai-provider, --ai-model, --ai-budget | Live analyst provider, provider:model-id, and spending cap in USD (default 0.10) |
-q, -v, --debug | Quiet / verbose / debug |
Other commands: startup-sbom tui (interactive UI), startup-sbom ai … (AI analysis
and agent servers), startup-sbom intel … (CVE intelligence lookup),
startup-sbom db update|status|clear (cache KEV/EPSS for offline use),
startup-sbom schema (JSON Schema of the native report), startup-sbom version.
Exit codes: 0 success, 1 --fail-on threshold reached, 2 usage or target
error, 3 internal error.