REPL / cdxi

June 11, 2026 · View on GitHub

cdxi opens an interactive shell for creating, importing, querying, and reviewing CycloneDX BOMs.

It is useful when you want fast, ad hoc investigation without writing one-off scripts.

Who should use this

Developers — inspect dependencies, services, formulation data, and evidence quickly
AppSec engineers — triage audit annotations, provenance signals, and dependency relationships
IR / platform teams — pivot through OBOM categories and runtime inventory interactively

Quick start

# Start an empty REPL
cdxi

# Import a BOM immediately
cdxi bom.json

# Import an enriched evidence BOM
cdxi bom.evinse.json

If bom.json exists in the current directory, cdxi imports it automatically.

Common workflows

Create a BOM and inspect it

.create .
.summary
.aibom
.print
.tree

Search and query

.search spring
.query components[name ~> /spring/i]
.sort name
.inspect pkg:npm/lodash@4.17.21

Review provenance and trusted publishing

.trusted
.provenance

Review source-derived crypto inventory

.cryptos
.sourcecryptos

Review unpackaged native file inventory from images and rootfs snapshots

.unpackagedbins
.unpackagedlibs

Review audit output carried in annotations

.auditfindings
.auditactions
.dispatchedges

Review Cargo-native hotspots and workflows

.cargohotspots
.cargoworkflows

Review Go Evinse and Golem evidence

.golemsummary
.golemhotspots
.golemcoverage
.golemtips

Review evidence and services

.occurrences
.callstack
.services
.formulation

OBOM investigation pivots

.osinfocategories
.processes
.services_snapshot
.startup_items
.obomtips

HBOM investigation pivots

.hbomsummary
.hbomdiagnostics
.hbomfirmware
.hbombuses
.hbompower
.hbomtips

Command reference

BOM lifecycle

Command	Description
`.create <path>`	Generate a BOM for a local path and load it into the session
`.import <path>`	Import a CycloneDX JSON BOM, SPDX JSON-LD BOM, or `.cdx` / `.proto` binary
`.save [path]`	Save the current BOM
`.summary`	Print a high-level BOM summary
`.aibom`	Render an operator-friendly AI-BOM view with pedigree, datasets, licenses, and quantization explanations
`.sbom`	Print the current BOM object
`.exit`	Exit the shell

Command	Description
`.search <text>`	Case-insensitive search across common component fields
`.query <jsonata>`	Run a raw JSONata expression
`.sort <field-or-jsonata-order>`	Sort components and print the result
`.inspect <name-or-purl-fragment>`	Print the full JSON for a matching component
`.update \| query \| object \|`	Modify components with a JSONata update expression

Inventory views

Command	Description
`.print`	Print components as a table
`.tree`	Print the dependency tree
`.provides`	Print the `provides` tree
`.cryptos`	Show `cryptographic-asset` components
`.sourcecryptos`	Show source-derived crypto algorithm components
`.unpackagedbins`	Show executable file components not owned by OS packages
`.unpackagedlibs`	Show shared library file components not owned by OS packages
`.instrumented`	Show dynamically instrumented libraries and verification evidence
`.frameworks`	Show framework components
`.licenses`	Show license distribution
`.tagcloud`	Show a text cloud from component descriptions and tags
`.validate`	Validate the current BOM against CycloneDX JSON Schema

Provenance and trust

Command	Description
`.trusted`	Show components with trusted publishing metadata
`.provenance`	Show components with registry provenance evidence

Audit-oriented commands

Command	Description
`.auditfindings`	Summarize `--bom-audit` and `cdx-audit` annotations from the loaded BOM
`.auditactions`	Show `cdx-audit` next actions and upstream guidance
`.dispatchedges`	Show correlated sender → receiver workflow edges captured by predictive audit

These commands are most useful after importing a BOM generated with --bom-audit or a BOM annotated by cdx-audit.

Cargo-oriented commands

Command	Description
`.cargohotspots`	Show Cargo package components with high-signal source, workspace, target, or build fields
`.cargoworkflows`	Show Cargo-native formulation entries plus Cargo-related GitHub Actions/setup/run steps

These commands are most useful after importing a Cargo SBOM generated with --include-formulation, --bom-audit, or both.

Go Evinse and Golem commands

Command	Description
`.golemsummary`	Summarize Golem tool metadata, call graph mode, counts, build surface, and evidence coverage
`.golemhotspots`	Show Go components with security, local replacement, private module, or vendored signals
`.golemcoverage`	Show Go components with Golem occurrence, scope, or call-stack evidence
`.golemtips`	Print suggested Go Evinse/Golem investigation pivots

These commands are most useful after importing a BOM generated with evinse -i bom.json -o bom.evinse.json -l go. Pair them with .occurrences, .callstack, and .auditfindings for source evidence and BOM audit triage.

Evidence and SaaSBOM review

Command	Description
`.occurrences`	Show components with occurrence evidence
`.callstack`	Show components with call-stack evidence
`.services`	Show services
`.vulnerabilities`	Show vulnerabilities from a VDR
`.formulation`	Show formulation data

HBOM and host hardware review

Command	Description
`.hbomsummary`	Summarize HBOM host metadata, evidence coverage, class mix, and diagnostics
`.hbomclasses`	Show component counts by HBOM hardware class
`.hbomevidence`	Show collector profile plus command and observed-file evidence
`.hbomdiagnostics`	Show parsed command diagnostics, issue counts, and install/privilege hints
`.hbomfirmware`	Show firmware, board, TPM, and update-managed components plus host firmware provenance
`.hbombuses`	Show USB, PCI, display-link, and external-expansion components with bus-security pivots
`.hbompower`	Show power and battery components with detailed runtime and design-capacity telemetry
`.hbomtips`	Print suggested HBOM investigation pivots

OBOM and runtime inventory

Command	Description
`.osinfocategories`	List available osquery-derived categories
`.obomtips`	Print suggested OBOM investigation pivots
`.<category>`	Run a built-in OS-query category command such as `.processes`, `.services_snapshot`, `.scheduled_tasks`, or `.startup_items`

Input types

cdxi can import:

CycloneDX JSON BOMs
SPDX JSON-LD documents, converted into a CycloneDX-like interactive view
protobuf .cdx / .proto BOMs
OCI references such as ghcr.io/... or docker.io/... when a CycloneDX attachment is present

REPL history

History is stored under $HOME/.config/.cdxgen/.repl_history.

Set CDXGEN_REPL_HISTORY to override the history file location.

Security notes

.create can invoke the same dependency-resolution paths as cdxgen; treat untrusted source trees with the same caution you would use for CLI scans.
.query and .update execute JSONata expressions against the loaded BOM. They are powerful and intended for trusted interactive use.
Imported audit annotations may contain repository URLs, workflow file paths, and remediation notes. Review before sharing screenshots or session logs.

Cargo analyst tips

Generate Cargo BOMs with --include-formulation to surface build.rs, native-helper, and workspace metadata.
Add --bom-audit when you want Cargo-native workflow/build correlations such as mutable Cargo setup actions or Cargo build/test steps against native build surfaces.
Use .cargohotspots first to identify yanked crates, local/git sources, and build-only workspace helpers.
Use .cargoworkflows next to compare Cargo formulation signals with the exact GitHub Actions/setup/cache/build steps seen in CI.

Container, rootfs, and CBOM tips

Use .unpackagedbins and .unpackagedlibs after importing a container or rootfs BOM when you want to inspect executable or shared-library file components that were not traced back to OS package ownership.
Use .sourcecryptos after importing a CBOM or an SBOM generated with --include-crypto when you want just the source-derived crypto algorithms detected from JavaScript or TypeScript AST analysis.
Pair .sourcecryptos with .inspect <name> when you want the exact cdx:crypto:sourceLocation and SrcFile evidence for a detected algorithm.