CycloneDX 1.6 added the cryptographic asset model in 2024, and tooling for it is still thin. Producers emit documents that look right and fail on a consumer; consumers reject documents without saying which field. The first real CBOMs we validated had over a hundred schema errors between them.
Paste one below. You get every structural finding with its JSON path, and a risk verdict per asset from the same scorer that grades our discovery agent's findings — not a second implementation written for this page.
What gets checked
Structural conformance to the CycloneDX 1.6 cryptographic asset model — the checks that decide whether another tool can consume the document:
- Envelope.
bomFormat, and aspecVersionof at least 1.6 —cryptoPropertiesdoes not exist before it, so an older document cannot express a CBOM at all. - Closed enums.
assetType,algorithmProperties.primitiveandrelatedCryptoMaterialProperties.typeare fixed vocabularies. A plausible-looking value outside them is the most common producer bug. - References. Every
bom-refunique, and everysignatureAlgorithmRef,subjectPublicKeyRefand dependency edge resolving to a component that exists. A dangling reference is worse than a missing one — it looks resolvable. - Dates.
notValidBeforeandnotValidAfteras RFC 3339 date-times, not bare dates or epoch integers. - Bounds.
nistQuantumSecurityLevelwithin 0–6; key sizes non-negative integers.
How assets are scored
By pqcrypta-crypto-scoring — the same crate, linked directly, that
grades findings for the discovery agent's offline assessment and the platform's
ingestion path. It has no dependencies and no second implementation, which is the
point: a verdict here is the verdict you would get from the agent on the same
facts.
Scoring is separate from validation. A structurally perfect CBOM full of RSA-1024 validates cleanly and scores badly, which is the useful answer.
From CI
curl -sS -X POST --data-binary @cbom.json \
https://pqcrypta.com/cbom/api.php \
| jq -e '.ok and (.summary.byRisk.critical // 0) == 0'
Exits non-zero when the document stops validating or a critical-risk asset appears.
A document with findings returns 200 with ok: false; only an
unprocessable request returns 422, so a pipeline can tell "your CBOM has problems"
from "the request was malformed".
Need a CBOM to test with? The discovery agent exports one,
and so does GET /crypto-assets/export/cbom on the platform API.