Install your project into a virtual environment with uv, PDM or Conda, then run the CycloneDX Python tool in its environment mode against that environment. The tool's README says it does not read the uv or PDM manifests and lockfiles directly, but it fully supports their virtual environments.
What the tool reads directly
The CycloneDX Python tool lists its supported data sources:
| Source | Support |
|---|---|
| Python virtual environment | Supported |
| Poetry manifest and lockfile | Supported |
| Pipenv manifest and lockfile | Supported |
| Pip requirements file | Supported |
| PDM manifest and lockfile | Not explicitly supported; PDM virtual environments are |
| uv manifest and lockfile | Not explicitly supported; uv virtual environments are |
| Conda as a package manager | Not supported since version 4; Conda Python environments are, via the methods above |
The command line has subcommands named environment, requirements, pipenv and poetry. For the three tools in this post, environment is the one you want.
The general recipe
- Create or sync the environment with your package manager so it matches the lockfile.
- Install the SBOM tool. It runs on Python 3.9 or newer and installs with pip, pipx, Poetry or uv. Install it outside the project environment if you can, so the tool itself does not appear in your SBOM.
- Run the environment command against the project environment's interpreter. Check the tool documentation for the exact flags for your version, since they can change.
- Write the output to a named file.
- Validate the file and compare the component count with the lockfile.
Step 2 matters more than it looks. If you install the generator into the same environment you are describing, it and its dependencies show up in the file, and you will have to explain them.
Why environment mode is a good fit
An environment is the real installed result. It holds exactly the packages and versions that were resolved, whatever tool resolved them. That is why the README can promise support for uv and PDM environments without understanding their lockfile formats.
The tradeoff is that an SBOM from an environment shows what is installed there, which includes anything extra you installed by hand or any development group you synced. If you want a runtime only file, build the environment without dev groups first. If you build with them, you will get them in the SBOM.
Conda specifics
Conda environments contain Python packages and also non Python packages such as compiled libraries. The tool reads the Python environment. It will not necessarily describe the native packages Conda installed alongside. If those matter for your product, which they often do for data and machine learning work, note that the file covers the Python layer only, and check what another scanner or a container image scan adds.
Check your result
- Pick three packages you know are in the lockfile and confirm they are present with the same versions.
- Check that nothing from the SBOM tool's own dependency set appears.
- Confirm the root component describes your project, not the environment path.
- If you use extras, confirm the ones you ship are installed when the file is generated.
When a lockfile route would be better
If your project uses Poetry or Pipenv, the tool can read the manifest and lockfile directly, which avoids needing an installed environment. For uv and PDM projects, environment mode is the documented path today, but check the project documentation, since support can change.
Safeguard's SBOM and dependency scanning reads Python manifests, lockfiles and SBOM files, so you can test your result. Try the free scan.
Quick check
Do I need an environment if I use Poetry?
No. The tool has a Poetry command that reads the manifest and lockfile directly.
Will a Conda SBOM list native libraries?
Do not assume so. The tool reads the Python environment. Check the output for non Python packages and add another scan if they matter.
Sources
Last reviewed: 19 October 2026.
