Mini Software Composition Analysis (SCA) Tool

A FastAPI project that accepts a requirements.txt file, package.json file, or .zip archive upload, parses dependencies and versions, detects licenses from a mock database, checks vulnerabilities with the OSV API, and can generate SBOM JSON exports.

Project Structure

app/
|-- api/
|   |-- routes/
|   |   `-- parser.py
|   `-- __init__.py
|-- schemas/
|   |-- requirements.py
|   `-- __init__.py
|-- services/
|   |-- dependency_builder.py
|   |-- license_db.py
|   |-- package_json_parser.py
|   |-- parser.py
|   |-- sbom_generator.py
|   |-- vulnerability_scanner.py
|   `-- __init__.py
|-- __init__.py
`-- main.py
requirements.txt
README.md

Setup

pip install -r requirements.txt
python -m uvicorn app.main:app --reload

Endpoints

GET /

Browser page with a file upload form that sends a requirements.txt file, package.json file, or .zip archive to the API and displays dependencies in a table with red/green vulnerability badges.

The UI also includes a Download SBOM button that exports the latest scan as a simple JSON SBOM.

POST /parse-requirements

Upload a requirements.txt file, package.json file, or .zip archive using multipart form-data with the field name file.

If a zip archive is uploaded, the API extracts it safely, searches for requirements.txt or package.json automatically, and scans the first supported manifest it finds closest to the archive root.

POST /sbom

Upload the same supported manifest types to receive a simple SBOM JSON file with:

{
  "components": [
    {
      "name": "fastapi",
      "version": "0.116.1",
      "license": "MIT"
    }
  ]
}

POST /generate-sbom

Upload the same supported manifest types to receive a CycloneDX 1.7 JSON SBOM file for download.

Example response:

{
  "source": "requirements.txt",
  "language": "Python",
  "dependencies": [
    {
      "name": "fastapi",
      "version": "0.116.1",
      "specifier": "==",
      "license": "MIT",
      "vulnerabilities": [],
      "raw": "fastapi==0.116.1"
    },
    {
      "name": "uvicorn",
      "version": "0.35.0",
      "specifier": ">=",
      "license": "BSD-3-Clause",
      "vulnerabilities": [],
      "raw": "uvicorn>=0.35.0"
    }
  ],
  "total": 2
}

Notes

• Open http://127.0.0.1:8000/ for the upload page
• Open http://127.0.0.1:8000/docs for Swagger UI
• The parser ignores blank lines, comments, and pip option lines such as -r other.txt
• package.json scanning reads dependencies and devDependencies, and strips version prefixes such as ^ and ~
• The UI shows the detected language type as Python or Node.js based on the manifest that was scanned
• License detection uses a mock in-project database and returns Unknown when a package is not listed
• Zip archives are scanned safely and rejected if they contain unsafe paths or no supported manifest file
• Vulnerabilities are fetched from the OSV API using ecosystem PyPI for Python dependencies and npm for package.json dependencies; if the API fails, the dependency falls back to an empty vulnerabilities list
• /sbom exports a simple JSON SBOM with components containing name, version, and license
• SBOM output follows a CycloneDX 1.7 JSON structure with metadata, package URLs, dependency relationships, and vulnerabilities tied to affected components