SBOM Coverage for PyPI Packages
Detected by parsing file content (not file extensions)
Schema validation against CycloneDX / SPDX specs
File format breakdown (JSON, XML, tag-value)
Each package version ships multiple wheels (one per platform/Python version). This shows SBOM coverage at the individual wheel level.
The Transparency Exchange API (TEA) is an open standard for discovering SBOMs. You can query this server using tea-cli:
# Install the TEA CLI
$ pip install libtea[cli]
# Inspect a PyPI package — discovers SBOMs via TEA in one shot
$ tea-cli inspect "urn:tei:purl:pypi.sbomify.com:pkg:pypi/[email protected]"
# Search for a specific package version by PURL
$ tea-cli search-releases --id-type PURL \
--id-value "pkg:pypi/[email protected]" --domain pypi.sbomify.com
Also available as a Python library:
from libtea import TeaClient