[masahiroid]

Adds two Apache-2.0 tools with CycloneDX JSON SBOM generation and analysis capabilities:

• SecuLens: TypeScript CLI/library importing CycloneDX 1.4–1.7 and SPDX 2.2/2.3 JSON, matching npm/PyPI/Composer dependencies against OSV advisory records, evaluating license policies, and generating Word/JSON reports. npm SBOM generation delegates to npm sbom.
• SBOM Vulnerability Scanner: VS Code extension generating/importing CycloneDX and SPDX JSON, providing dependency/license inspection, known-vulnerability scanning through Trivy or npm audit, and HTML/JSON/Word reports. Classified as APPLICATION because the schema has no VS Code extension packaging category. The version field conservatively lists 1.4, which its built-in CycloneDX exporter emits; this does not claim complete validation of every CycloneDX feature.

The listings describe SBOM-related functionality only. No certification or regulatory-conformance claims are made. SecuLens's separate Python/PHP implementations are not submitted as duplicate entries here.

Capability references

SecuLens source inspected at c487ccf20bcd6d792d365f542ddf803e1d3d71ee:

• README: installation, SBOM import/generation, supported formats and scope
• CycloneDX input adapter

SBOM Vulnerability Scanner source inspected at aba8d3d7f3ab90cbffd51f50a89645c65e8f289e:

• README: generation, external-document import, inspection and reporting
• CycloneDX 1.4 exporter
• Document import

Validation

Both new files pass check-jsonschema --schemafile schemas/tool.schema.json. Descriptions are within the 250-character limit. No existing entries for these tools were found. Generated tools.json is intentionally unchanged, following the contribution instructions.

[Copilot]

🟡 Changes recommended

The scanner listing overstates its BOM vulnerability-analysis capability and misidentifies its SPDX output format.

2 open issues

• Remove incorrect BOM vulnerability analyzer classification · New
• Correct SPDX export format classification · New

What changed in this PR

Adds two open-source tools to the CycloneDX tool catalog.

Changes:

• Adds SecuLens with SBOM generation, analysis, and reporting capabilities.
• Adds SBOM Vulnerability Scanner with generation, import, inspection, and reporting metadata.

File	Description
tools/​seculens.json	Registers the SecuLens CLI and library.
tools/​sbom_vulnerability_scanner.json	Registers the VS Code extension.

_{Review effort: Balanced}

[masahiroid]

@jkowalleck Thanks for the review. All your comments are addressed:

• Removed the AUTHOR claim from both tools (chore: fix false claims for function "AUTHOR" #130).
• Renamed the scanner file to masahiroid-sbom-vulnerability-scanner.json, using my GitHub account name. I can change it to masahirocom-... if you prefer.

I also addressed the two Copilot comments: the scanner no longer claims SECURITY_VULNERABILITIES, because it scans source directories rather than BOM contents, and the description now states the SPDX output per generator, matching scanner release 9.7.0.

Could you please approve the pending workflow runs and take another look?

[jkowalleck]

Schema validation errors were encountered.
  tools/masahiroid-sbom-vulnerability-scanner.json::$.tool.description: 'VS Code extension that generates CycloneDX JSON and SPDX SBOMs (SPDX JSON with Syft or Trivy, tag-value with its built-in npm manifest reader), imports CycloneDX/SPDX JSON SBOMs, explores dependencies and licenses, scans source directories for known vulnerabilities using Trivy or npm audit, and exports HTML, JSON and Word reports.' is too long

max 255 chars.

[masahiroid]

Shortened the description of the SBOM Vulnerability Scanner entry to fit the 225-character limit. The AUTHOR function was removed and the file was renamed in the previous push. Could you take another look? Thanks!