Validate a CycloneDX SBOM: bomFormat, supported specVersion (1.4–1.6), every component has name+version+purl, and top-level dependencies present. Satisfies the EU CRA Annex I Part II(1) machine-readable SBOM requirement. Zero network. Feeds the SLSA provenance verifier (art-136).
CycloneDX 1.4–1.6EU CRA Annex ISBOMFull applicability Dec 2027W3C VC §13.11Zero PIIClient-side only
🔒 All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only.
Scope
Root stage of the sbom-provenance-attestation chain (art-135→136→137). Validates CycloneDX SBOM structure per the EU CRA Annex I minimum: machine-readable format, version 1.4/1.5/1.6, all components carry a purl, and top-level dependencies are declared. Flags components missing a purl. Verdict feeds the SLSA provenance verifier (art-136). CRA full applicability 11 Dec 2027, penalty up to €15M or 2.5% of global turnover.
Pass the execution_hash above as parent_hashes[0] when calling verify_slsa_provenance (art-136) to continue the sbom-provenance-attestation chain.
Ask your agent
Copy this paragraph into Claude, OpenClaw, or any MCP-aware agent to run this exact tool, with this sample, and verify the artifact.
Run the AINumbers MCP tool `validate_cyclonedx_sbom`. Task: Validate a CycloneDX SBOM (bomFormat, specVersion, component name/version/purl, top-level dependencies) against the EU CRA Annex I machine-readable SBOM requirement.
Call it with arguments: {"policy_parameters":{"sbom":{"bomFormat":"CycloneDX","specVersion":"1.6","components":[{"name":"express","version":"4.18.2","purl":"pkg:npm/express@4.18.2"}],"dependencies":[{"ref":"pkg:npm/express@4.18.2","dependsOn":[]}]}}}
Verify before trusting: call `verify_execution_hash` on mcp.ainumbers.co (https://mcp.ainumbers.co/mcp) with the parameter `claimed_hash` set to the returned `execution_hash`, passing the full artifact the run returned (the object containing `policy_parameters` + `output_payload` + `execution_hash`; equivalently `policy_parameters` + `output_payload` with `claimed_hash`), not the bare hash string, or re-run the in-page WebMCP tool `validate_cyclonedx_sbom`.
Return the ledger link https://ledger.ainumbers.co/ so a human can re-verify without contacting us.
PII rule: All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only.
Open the tool with the sample prefilled: https://ainumbers.co/chaingraph/art-135-cyclonedx-sbom-validator.html#p=v1.H4sIAAAAAAAA_wHMADP_eyJzYm9tIjp7ImJvbUZvcm1hdCI6IkN5Y2xvbmVEWCIsInNwZWNWZXJzaW9uIjoiMS42IiwiY29tcG9uZW50cyI6W3sibmFtZSI6ImV4cHJlc3MiLCJ2ZXJzaW9uIjoiNC4xOC4yIiwicHVybCI6InBrZzpucG0vZXhwcmVzc0A0LjE4LjIifV0sImRlcGVuZGVuY2llcyI6W3sicmVmIjoicGtnOm5wbS9leHByZXNzQDQuMTguMiIsImRlcGVuZHNPbiI6W119XX19OsMuyswAAAA