SBOMApp MCP Server

Connect to a remote SBOM MCP Server for AI-powered software bill of materials analysis, vulnerability scanning, and dependency management.

🚀 Quick Start Guide

Step 1: Install the Extension

1. Open VS Code
2. Go to Extensions (Ctrl+Shift+X or Cmd+Shift+X on Mac)
3. Search for "SBOMApp MCP Server"
4. Click Install

Or install directly from the VS Code Marketplace

Step 2: Configure the Remote Server

1. Press Ctrl+Shift+P (or Cmd+Shift+P on Mac) to open Command Palette
2. Type "SBOMApp: Configure Remote Server" and press Enter
3. Enter your Server URL:
   • Format: http://your-server:3000 or http://your-server:3000/mcp
   • Example: http://localhost:3000 or https://sbom.company.com
4. Enter your API Key (provided by your administrator)

Step 3: Test the Connection

1. Press Ctrl+Shift+P again
2. Type "SBOMApp: Test Connection" and press Enter
3. You should see a success message with available tools count

Step 4: Start Using with Copilot

Once connected (green status bar shows ✓), you can ask GitHub Copilot:

"Check if lodash 4.17.0 has any security vulnerabilities"
"Generate an SBOM for my current project"
"Analyze the dependencies in this repository"

Features

• 🔗 Easy Configuration: Simple setup wizard to connect to your SBOM MCP Server
• 🔐 Secure Authentication: Bearer token authentication with secure storage
• ✅ Connection Testing: Verify your server connection before use
• 📊 Status Bar Indicator: See connection status at a glance
• 🛠️ Tool Browser: View all available SBOM analysis tools
• 🤖 Copilot Integration: Seamlessly works with GitHub Copilot

Commands

Configuration

This extension provides the following settings:

Available Tools

Once connected, you can use these SBOM analysis tools with GitHub Copilot:

💬 Example Copilot Prompts

Once configured, try asking Copilot these questions:

Security Scanning

• "Check if lodash 4.17.0 has any security vulnerabilities"
• "Is express version 4.17.1 secure to use?"
• "Scan my project for vulnerable dependencies"

SBOM Generation

• "Generate an SBOM for my current project"
• "Create a software bill of materials for /path/to/project"

Dependency Analysis

• "Analyze the dependencies in this repository"
• "What are the risks in my project's dependencies?"
• "Show me the dependency tree for this project"

License Compliance

• "What licenses are used by my project's dependencies?"
• "Check for copyleft licenses in my project"
• "Analyze license compliance for my dependencies"

Requirements

• VS Code 1.85.0 or higher
• Access to a running SBOM MCP Server
• Valid API key for authentication

🔑 Getting an API Key

Contact your SBOM MCP Server administrator to obtain an API key.

For Server Administrators: The API key is typically configured as:

• GITLAB_CI_API_KEY environment variable, or
• MCP_API_KEY environment variable

Troubleshooting

Connection Failed

• Verify the server URL is correct (should end with /mcp)
• Check that the server is running and accessible
• Ensure your API key is valid and not expired
• Check if firewall allows the connection

Tools Not Working

• Make sure the connection is established (green ✓ in status bar)
• Check VS Code MCP settings are configured correctly
• Try disconnecting and reconnecting
• Restart VS Code if issues persist

Status Bar Not Showing

• Check that sbomRemoteMcp.showStatusBar is enabled in settings
• Try reloading VS Code (Ctrl+Shift+P → "Reload Window")

Authentication Errors

• Verify your API key is correct
• Ensure the API key has proper permissions
• Contact your administrator if the key was recently rotated

Privacy & Security

• API keys are stored in VS Code's secure storage
• All communication uses HTTPS (when configured)
• No data is sent to third parties
• Credentials are never logged or exported

License

MIT License

Support

For issues or feature requests, please contact your SBOM MCP Server administrator or visit our GitHub repository.

Support

• 📧 Email: sbomappsupport@iarm.com