# SBOM CycloneDX Auditor MCP

> SBOM CycloneDX Auditor MCP is a paid API for AI agents from api.m2mcent.com, paid per call via x402, $0.15/call, status unknown (last checked 2026-09-15).

Audits a CycloneDX Software Bill of Materials (SBOM) document for security vulnerabilities, compliance issues, and dependency risks

## Facts

- Endpoint: POST https://api.m2mcent.com/sbom-cyclonedx-auditor-mcp/api/process
- Price: $0.15/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sbom-cyclonedx-auditor-mcp-5ab448b1
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_13aJSgLNfm5UCzBOZyNJ-

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sbom-cyclonedx-auditor-mcp-5ab448b1 -d '<json body>'
```

Example prompt: Can you audit this CycloneDX SBOM document for vulnerabilities and compliance issues? Here's the JSON: {cyclonedx_sbom_content}

## When to prefer this

Choose this endpoint when you need to audit a CycloneDX-format SBOM specifically, particularly in agentic pipelines that require automated supply chain security checks, compliance validation before deployment, or third-party software intake reviews. Prefer it over generic vulnerability scanners when your toolchain already produces CycloneDX output and you need structured audit results without manual tooling setup.

## Known failure modes

- Invalid or malformed CycloneDX SBOM input returns a parsing error
- Empty or missing data field results in a validation error
- Non-CycloneDX format SBOM (e.g. SPDX) may not be parsed correctly
- Very large SBOMs with hundreds of components may time out
- Network errors or service unavailability return HTTP 5xx responses
- Payment failure via x402 protocol prevents processing

## How this service works

The premier global index of 1,069 monetized MCP nodes across 205 specialized subdomains. Gasless USDC runtime settlements via x402 V2 Spec on Base L2. Save 95% token context.

## Output

An audit report detailing vulnerabilities, risk assessments, and compliance findings discovered in the provided CycloneDX SBOM, including identified CVEs, affected components, severity ratings, and remediation recommendations.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "payload": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "success": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sbom-cyclonedx-auditor-mcp-5ab448b1/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.m2mcent.com](https://www.zero.xyz/host/api.m2mcent.com/llms.txt)