Validate an SPDX SBOM: spdxVersion (2.x or 3.x), SPDXID document identifier, every package has name+versionInfo+downloadLocation (or purl externalRef), and relationships present. SPDX-format counterpart to ART-135. Feeds the CRA Annex I conformance checker (art-139).
SPDX 2.x / 3.xEU CRA Annex ISBOMFull applicability Dec 2027W3C VC §13.11Zero PIIClient-side only
🔒 All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only.
Scope
Root stage of the cra-product-conformance chain (art-138→139→140). SPDX-format SBOM validator: checks spdxVersion pattern (SPDX-2.x or SPDX-3.x), document identifier, each package must carry name+versionInfo+downloadLocation or a purl externalRef, and relationships must be present. Use art-135 for CycloneDX format. Both validate the EU CRA Annex I Part II(1) machine-readable SBOM requirement.
Pass the execution_hash above as parent_hashes[0] when calling check_cra_annex1_completeness (art-139) to continue the cra-product-conformance chain.
Ask your agent
Copy this paragraph into Claude, OpenClaw, or any MCP-aware agent to run this exact tool, with this sample, and verify the artifact.
Run the AINumbers MCP tool `validate_spdx_sbom`. Task: Validate an SPDX SBOM (spdxVersion 2.x/3.x, SPDXID, package name/versionInfo/downloadLocation or purl externalRef, relationships) against the EU CRA Annex I machine-readable SBOM requirement.
Call it with arguments: {"policy_parameters":{"sbom":{"spdxVersion":"SPDX-2.3","SPDXID":"SPDXRef-DOCUMENT","packages":[{"name":"express","versionInfo":"4.18.2","downloadLocation":"https://registry.npmjs.org/express/-/express-4.18.2.tgz"}],"relationships":[{"spdxElementId":"SPDXRef-DOCUMENT","relationshipType":"DESCRIBES","relatedSpdxElement":"SPDXRef-Package-express"}]}}}
Verify before trusting: call `verify_execution_hash` on mcp.ainumbers.co (https://mcp.ainumbers.co/mcp) with the parameter `claimed_hash` set to the returned `execution_hash`, passing the full artifact the run returned (the object containing `policy_parameters` + `output_payload` + `execution_hash`; equivalently `policy_parameters` + `output_payload` with `claimed_hash`), not the bare hash string, or re-run the in-page WebMCP tool `validate_spdx_sbom`.
Return the ledger link https://ledger.ainumbers.co/ so a human can re-verify without contacting us.
PII rule: All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only.
Open the tool with the sample prefilled: https://ainumbers.co/chaingraph/art-138-spdx-sbom-validator.html#p=v1.H4sIAAAAAAAA_wFIAbf-eyJzYm9tIjp7InNwZHhWZXJzaW9uIjoiU1BEWC0yLjMiLCJTUERYSUQiOiJTUERYUmVmLURPQ1VNRU5UIiwicGFja2FnZXMiOlt7Im5hbWUiOiJleHByZXNzIiwidmVyc2lvbkluZm8iOiI0LjE4LjIiLCJkb3dubG9hZExvY2F0aW9uIjoiaHR0cHM6Ly9yZWdpc3RyeS5ucG1qcy5vcmcvZXhwcmVzcy8tL2V4cHJlc3MtNC4xOC4yLnRneiJ9XSwicmVsYXRpb25zaGlwcyI6W3sic3BkeEVsZW1lbnRJZCI6IlNQRFhSZWYtRE9DVU1FTlQiLCJyZWxhdGlvbnNoaXBUeXBlIjoiREVTQ1JJQkVTIiwicmVsYXRlZFNwZHhFbGVtZW50IjoiU1BEWFJlZi1QYWNrYWdlLWV4cHJlc3MifV19fVCaBNdIAQAA