Syft, Trivy, cdxgen and Microsoft sbom-tool all generate SBOMs, but they output different formats. Syft and Trivy write CycloneDX and SPDX, cdxgen is built around CycloneDX with SPDX 3.0.1 export, and sbom-tool writes SPDX. All four are open source.
Safeguard publishes this guide and sells a competing product, so we describe other tools only from their own documentation. Facts below are as of 19 October 2026.
Key takeaways
- Syft covers container images and filesystems, and can convert between formats.
- Trivy writes CycloneDX and SPDX, and does not support CycloneDX XML.
- cdxgen defaults to CycloneDX 1.7 and exports SPDX 3.0.1 JSON-LD.
- sbom-tool defaults to SPDX 2.2 and uses ClearlyDefined for license data.
What does each generator do?
Syft. A CLI tool and Go library under Apache-2.0. It takes OCI, Docker and Singularity images plus directories and archives. Outputs include CycloneDX, SPDX and Syft JSON, and it can create signed attestations following in-toto.
Trivy. Generates SBOMs through its format option on image, fs and rootfs commands. Formats are CycloneDX and SPDX. By default the CycloneDX output has no vulnerabilities, and adding the vulnerability scanner includes them.
cdxgen. A CLI, library, REPL and server under Apache-2.0. It supports many languages and package managers, container images and more. CycloneDX 1.6, 1.7 and 2.0 are generation targets.
sbom-tool. A Microsoft CLI under MIT that generates SBOMs for build artifacts using Component Detection libraries. SPDX 2.2 is the default, and SPDX 3.0 is available with an argument. The README says the project does not accept outside contributions.
Comparison table
| Criteria | Syft | Trivy | cdxgen | sbom-tool |
|---|---|---|---|---|
| Formats | CycloneDX, SPDX, Syft JSON | CycloneDX, SPDX | CycloneDX, SPDX 3.0.1 export | SPDX 2.2, SPDX 3.0 |
| Inputs | Images, filesystems | Images, filesystems, rootfs, VMs | Source, images, rootfs | Build artifact paths |
| License | Apache-2.0 | Apache-2.0 | Apache-2.0 | MIT |
| Invocation | CLI, Go library | CLI | CLI, library, server | CLI, NuGet package |
How to choose
- Confirm which SBOM format your customers or regulators ask for.
- Check your ecosystems against each tool's list.
- Decide whether you build from source or from images.
- Generate from one project with two tools and diff the component lists.
- Plan where you will store and analyze the SBOMs afterwards.
Safeguard can generate and import SBOMs, and the free scan at gold.safeguard.sh/scan needs no login.
Frequently asked questions
Can Syft output SPDX?
Yes. Its README lists CycloneDX, SPDX and Syft JSON among its formats.
Does Trivy support CycloneDX XML?
No. Its docs say XML output is not supported.
Which tool writes SPDX 3.0?
sbom-tool offers it as an option and cdxgen exports SPDX 3.0.1 JSON-LD.
Sources
- Syft: https://github.com/anchore/syft
- Trivy SBOM docs: https://trivy.dev/latest/docs/supply-chain/sbom/
- cdxgen: https://github.com/CycloneDX/cdxgen
- sbom-tool: https://github.com/microsoft/sbom-tool
Last reviewed: 19 October 2026.
