Development

SBOM SPDX / CycloneDX 许可证策略审计器

审计 SPDX 2.3 或 CycloneDX 1.5 组件许可证，输出 SARIF 和失败依赖链

text· 文本结果打开工具

快速开始

用三种语言从你的代码中调用此工具。

cURL

# 1) Request a presigned URL → returns { uploadUrl, storageKey }
curl -X POST 'https://api.elysiatools.com/api/upload/presign/sbom-spdx-cyclonedx-license-policy-auditor' \
  -H 'Content-Type: application/json' \
  -d '{"filename":"sbomFile.ext","contentType":"application/octet-stream","size":12345}'

# 2) PUT the file bytes directly to the presigned uploadUrl
curl -X PUT '<presigned uploadUrl>' \
  --data-binary @/path/to/file.ext

# 3) Call the tool, passing the returned storageKey for each file field
curl -X POST 'https://api.elysiatools.com/zh/api/tools/sbom-spdx-cyclonedx-license-policy-auditor' \
  -F 'sbomInput={"spdxVersion":"SPDX-2.3","SPDXID":"SPDXRef-DOCUMENT","documentDescribes":["SPDXRef-App"],"packages":[{"SPDXID":"SPDXRef-App","name":"app","versionInfo":"1.0","licenseConcluded":"MIT"},{"SPDXID":"SPDXRef-Lib","name":"server-lib","versionInfo":"2.0","licenseDeclared":"AGPL-3.0-only"}],"relationships":[{"spdxElementId":"SPDXRef-App","relationshipType":"DEPENDS_ON","relatedSpdxElement":"SPDXRef-Lib"}]}' \
  -F 'sbomFile=uploads/2026/01/01/your-tool-1700000000000-abc123.ext' \
  -F 'sbomFormat=auto' \
  -F 'policyPreset=balanced' \
  -F 'copyleftTolerance=weak' \
  -F 'allowedLicenses=' \
  -F 'deniedLicenses=AGPL-3.0-only' \
  -F 'failOnUnknown=true' \
  -F 'reportFormat=sarif'

API 参考

以 JSON 形式 POST 提交输入参数。文件类型参数需先单独上传。

请求端点

HTTP

POST https://api.elysiatools.com/zh/api/tools/sbom-spdx-cyclonedx-license-policy-auditor

请求参数

参数名	类型	必填	说明
sbomInput	textarea	否	—
sbomFile	file需先上传	否	—
sbomFormat	select	否	—
policyPreset	select	否	—
copyleftTolerance	select	否	—
allowedLicenses	textarea	否	—
deniedLicenses	textarea	否	—
failOnUnknown	checkbox	否	—
reportFormat	select	否	—

文件类型参数需先通过 POST /upload/sbom-spdx-cyclonedx-license-policy-auditor 上传，再将返回的 filePath 传入对应的文件字段。

响应格式

文本结果

JSON

{
  "result": "Processed text content",
  "error": "Error message (optional)",
  "message": "Notification message (optional)",
  "metadata": {
    "key": "value"
  }
}

MCP 集成

将此工具加入你的 Model Context Protocol 服务，让 AI 智能体可以列出并调用它。

服务配置

将以下内容加入你的 MCP 客户端配置：

mcp.json

{
  "mcpServers": {
    "elysiatools-sbom-spdx-cyclonedx-license-policy-auditor": {
      "name": "sbom-spdx-cyclonedx-license-policy-auditor",
      "description": "审计 SPDX 2.3 或 CycloneDX 1.5 组件许可证，输出 SARIF 和失败依赖链",
      "baseUrl": "https://api.elysiatools.com/mcp/sse?toolId=sbom-spdx-cyclonedx-license-policy-auditor",
      "command": "",
      "args": [],
      "env": {},
      "isActive": true,
      "type": "sse"
    }
  }
}

列出可用工具

连接到 SSE 端点后，列出已开放的工具：

tools/list

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/list"
}

调用此工具

通过工具 id 调用，参数由其参数表构建：

tools/call

{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "sbom-spdx-cyclonedx-license-policy-auditor",
    "arguments": {
  "sbomInput": "{\"spdxVersion\":\"SPDX-2.3\",\"SPDXID\":\"SPDXRef-DOCUMENT\",\"documentDescribes\":[\"SPDXRef-App\"],\"packages\":[{\"SPDXID\":\"SPDXRef-App\",\"name\":\"app\",\"versionInfo\":\"1.0\",\"licenseConcluded\":\"MIT\"},{\"SPDXID\":\"SPDXRef-Lib\",\"name\":\"server-lib\",\"versionInfo\":\"2.0\",\"licenseDeclared\":\"AGPL-3.0-only\"}],\"relationships\":[{\"spdxElementId\":\"SPDXRef-App\",\"relationshipType\":\"DEPENDS_ON\",\"relatedSpdxElement\":\"SPDXRef-Lib\"}]}",
  "sbomFile": "https://example.com/file.ext",
  "sbomFormat": "auto",
  "policyPreset": "balanced",
  "copyleftTolerance": "weak",
  "allowedLicenses": "",
  "deniedLicenses": "AGPL-3.0-only",
  "failOnUnknown": true,
  "reportFormat": "sarif"
}
  }
}

可用逗号分隔的 toolId 在一个会话中串联多个工具，例如 /mcp/sse?toolId=png-to-webp,jpg-to-webp,gif-to-webp（最多 20 个）。

文件参数仅支持公开的文件链接 URL（https://…）。不支持本地路径、data: URI 和 Base64 字符串。

有问题或反馈？请联系 [email protected]