# Sicher SBOM Generator

> Sicher SBOM Generator is a paid API for AI agents from sicher.halowerk.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-13).

Parses dependency files (package-lock.json, package.json, requirements.txt, go.mod, Cargo.lock) and generates a Software Bill of Materials in CycloneDX 1.5 or SPDX 2.3 format with package URLs per component.

## Facts

- Endpoint: POST https://sicher.halowerk.com/v1/sbom?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sicher-sbom-generator-ce83f509
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_P2Srp1R0krD3oezr89m_L

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sicher-sbom-generator-ce83f509 -d '<json body>'
```

Example prompt: Generate a CycloneDX 1.5 software bill of materials from my package-lock.json — I want a full pURL for every component so I know exactly which versions are actually installed, not just the ranges from my package.json.

## When to prefer this

Choose this endpoint when you need a machine-readable, standards-compliant SBOM (CycloneDX 1.5 or SPDX 2.3) with package URLs from actual dependency files, especially when you need to distinguish exact installed versions (from lockfiles) from declared ranges (from manifests). Prefer this over generic dependency parsers when compliance output format matters, or when downstream tools (vulnerability scanners, license checkers) require pURL-tagged CycloneDX or SPDX documents.

## Known failure modes

- Malformed or unparseable input file returns a parse error
- Unsupported file format returns an unsupported manifest type error
- Manifest-only input (e.g. package.json without lockfile) produces a BOM with version ranges rather than exact versions, which is noted explicitly
- Missing or empty dependency sections result in an empty component list
- Invalid SBOM format enum value returns a validation error

## How this service works

Parses package-lock.json, package.json, requirements.txt, go.mod and Cargo.lock and emits a bill of materials in CycloneDX 1.5 or SPDX 2.3, with a package URL per component. The distinction that decides whether the document is worth anything is made explicit: a lockfile names the versions actually installed, a manifest only names ranges, and a bill of materials built from ranges describes what might be installed rather than what is.

## Output

A structured SBOM document in either CycloneDX 1.5 or SPDX 2.3 format listing all resolved components with their name, version, and package URL (purl). The document distinguishes between lockfile-derived (exact installed versions) and manifest-derived (version ranges) components.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "files": {
   "type": "array",
   "items": {
    "type": "object",
    "required": [
     "content"
    ],
    "properties": {
     "content": {
      "type": "string",
      "maxLength": 4194304,
      "description": "File contents as text."
     },
     "filename": {
      "type": "string",
      "maxLength": 300,
      "description": "File name; the type is detected from content if absent."
     }
    },
    "additionalProperties": false
   },
   "maxItems": 10,
   "minItems": 1,
   "description": "The manifest or lock files."
  },
  "format": {
   "enum": [
    "cyclonedx",
    "spdx",
    "plain"
   ],
   "type": "string",
   "default": "cyclonedx",
   "description": "Output format."
  },
  "include_dev": {
   "type": "boolean",
   "default": false,
   "description": "Include development-only dependencies."
  },
  "project_name": {
   "type": "string",
   "default": "unnamed-project",
   "maxLength": 200,
   "description": "Name for the document metadata."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sicher-sbom-generator-ce83f509/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from sicher.halowerk.com](https://www.zero.xyz/host/sicher.halowerk.com/llms.txt)