chatsbom 0.5.1

ChatSBOM - Talk to your Supply Chain. Chat with SBOMs.

ChatSBOM

Talk to your Supply Chain. Chat with SBOMs.

ChatSBOM is a CLI tool for indexing and querying Software Bill of Materials (SBOM) data, providing deep insights into project dependencies.

Why ChatSBOM?

Standard tools like GitHub Dependency Graph don't allow sorting dependents by popularity (stars) (isaacs/github#1537). ChatSBOM solves this by collecting, indexing, and enabling natural language queries over SBOM data.

Features

• Discover: Find high-quality repositories on GitHub by stars and language.
• Collect: Enrich metadata and fetch dependency files (go.mod, package.json, etc.).
• Generate: Transform files into standard SBOM format using Syft.
• Index: Load SBOM data into ClickHouse for high-performance queries.
• Query: Use the CLI for stats/searches or AI-powered natural language chat.

Getting Started

1. Prerequisites

• Docker (for ClickHouse)
• Syft (for SBOM generation)
• uv (for AI-powered chat feature)

2. Installation

# Via pip
pip install chatsbom

# Via pipx
pipx install chatsbom

# Or run directly via uvx
uvx chatsbom

3. Setup

Start Database

Option 1: Using docker compose

docker compose up -d

Option 2: Using docker run

docker run -d --name clickhouse -p 8123:8123 --ulimit nofile=262144:262144 clickhouse/clickhouse-server:25.12-alpine
docker exec clickhouse clickhouse-client -q "CREATE DATABASE IF NOT EXISTS chatsbom"
docker exec clickhouse clickhouse-client -q "CREATE USER IF NOT EXISTS admin IDENTIFIED BY 'admin'"
docker exec clickhouse clickhouse-client -q "GRANT ALL ON *.* TO admin WITH GRANT OPTION"
docker exec clickhouse clickhouse-client -q "CREATE USER IF NOT EXISTS guest IDENTIFIED BY 'guest'"
docker exec clickhouse clickhouse-client -q "GRANT SELECT ON chatsbom.* TO guest"
docker exec clickhouse clickhouse-client -q "ALTER USER guest SET PROFILE readonly"

Configure Environment: Set your API keys

export GITHUB_TOKEN="your_github_token"
export ANTHROPIC_AUTH_TOKEN="your_anthropic_token"

4. Basic Workflow

# 1. Search and collect data
chatsbom github search --language go --min-stars 10000
chatsbom github repo --language go
chatsbom github release --language go
chatsbom github commit --language go
chatsbom github content --language go

# 2. Generate and index SBOMs
chatsbom sbom generate --language go
chatsbom db index --language go

# 3. Query insights
chatsbom db status
chatsbom db query gin
chatsbom chat

Use Case: Analyzing Framework Adoption

Find the most popular projects depending on a specific library (e.g., gin) using natural language.