{
      "tool_id": "art-135-cyclonedx-sbom-validator",
      "tool_version": "1.0.0",
      "display_name": "CycloneDX SBOM Validator (EU CRA Annex I)",
      "mcp_name": "validate_cyclonedx_sbom",
      "mandate_type": "compliance_mandate",
      "wave": 25,
      "gpu": false,
      "url": "https://ainumbers.co/chaingraph/art-135-cyclonedx-sbom-validator.html",
      "description": "Validates a CycloneDX SBOM against the EU CRA Annex I machine-readable SBOM requirement: bomFormat=CycloneDX, specVersion in [1.4,1.5,1.6], all components carry purl+name+version, top-level dependencies array present. Emits sbom_valid verdict and per-component gap list. Root stage of sbom-provenance-attestation chain.",
      "input_schema_ref": "chaingraph/art-135-cyclonedx-sbom-validator.html#manifest",
      "consumes": [],
      "feeds": [
        "art-136-slsa-provenance-verifier"
      ],
      "status": "live",
      "conformance_fixtures": true,
      "compute_capability": "server",
      "compute_images": [{"system":"sha256-source","image_id":"sha256:3f160ab65134e8918e39f71151aed591c8cd27e82ed90f22cff146f7fa75fcd1","valid_from":"2026-07-10"},{"system":"risc0","image_id":"sha256:a1a0bc89b5b1febaeda3519f6dbade0fa5ac16beeb143c4e1b01689573567bc6","valid_from":"2026-06-28"}],
      "compute_proof": {
        "type": "ZkVmReceipt",
        "system": "risc0",
        "receiptFormat": "groth16-bn254",
        "imageId": "sha256:a1a0bc89b5b1febaeda3519f6dbade0fa5ac16beeb143c4e1b01689573567bc6",
        "seal": "Lwfpvdt9mf1fbt5NsVLlK3uy3unT6rTpEn7Akd69VEwl215Eippwzy4nRsypBLm1SGXXslp8wTBx3Mk+X/biFCQ+WGf9u7hniUywXBbRMwRPwgZdNy7dOoz5smVaBVCaJMsTYzB+NHa0JAVROn9xckXx7SlOTiFOkWhaD7uva6YV5hfpLif37yayQLppD74LIwnj2Uw3ElhEVWxzZr4BjgDm2g/6HQfhhNQBcNvR7YR5/+XXNNcbVUZw1NbqHVDgLrDvhCU5Krl/FhFXLGRrAtnJOFNO0Dw8590MnE6icNgenCO101jyAnHXZl6kYmwQzZFqEnloLLSnAF6Md3+1cQ==",
        "journal": {
          "chaingraph_version": "0.4.0",
          "kernel_digest": "sha256:b678ddca7acdb020ecfe9ad3404580ffbc8bfc498caceee2042ab3574c957caf",
          "output": {
            "component_count": 1,
            "components_missing_purl": [],
            "format": "CycloneDX",
            "has_dependencies": true,
            "sbom_valid": true,
            "spec_version": "1.6"
          }
        }
      },
      "export_capability": [
        "json",
        "vc"
      ]
    }