PurpleRay / SBOM Analyzer

Know what’s in
your software.

A small, native desktop application that turns local software artifacts into a software bill of materials. Inspect components, compare scans, and export CycloneDX.

Download latest release View source on GitHub

Windows x64 · Linux x64 · Open source · Apache-2.0

PurpleRay dashboard showing local scan history, component totals, and the offline Knowledge Base — **A local overview.** Dashboard screenshot from v1.2.2, using synthetic demo data. No live advisory query was made. Select any screenshot to view it at full size.

From files to an inventory

A software inventory you can inspect.

Scan locally

Read package manifests, lock files, and native binaries. Scans run offline by default and never execute files in the selected folder.

Review what changed

Explore components and their evidence, compare completed scans, and review known issues through an optional OSV.dev check.

Export useful evidence

Produce a deterministic CycloneDX SBOM, export security findings, and inspect a BSI readiness report to see where inventory evidence is incomplete.

Online advisory checks are optional and require confirmation each time. They send only eligible, versioned Package URLs to OSV.dev. Readiness reporting helps review the evidence; it does not certify compliance.

Inside PurpleRay

The details, in view.

A component inventory and a scan report keep the underlying evidence close at hand. These screenshots use synthetic illustrative data; no live advisory query was made.

PurpleRay component table with package names, versions, and known-issue indicators in a synthetic demonstration — **Components & known issues.** Review the inventory and recorded advisory indicators. Synthetic demo data.

PurpleRay scan details report showing an inventory summary, evidence, and warnings for a synthetic scan — **Scan details.** Inspect the report and the context behind the results. Synthetic demo data.

Get PurpleRay

Start with a folder.

Choose the Windows or Linux package from the latest GitHub release. Installation instructions and checksums are included in the project documentation.

Download latest release

Linux requires GTK2. WSL2 is supported with WSLg.

—

Package downloads across all versions

The latest release is always available on GitHub.

Recorded GitHub package downloads, including prereleases. Excludes metadata and source archives; downloads are not unique users. Deleted assets retain their last observed count. Downloads of assets deleted before tracking began cannot be recovered.