{
  "stage": "stage2a-sbom",
  "generated_at": "2026-03-29T17:50:17.624Z",
  "sbom_generation": {
    "syft": {
      "componentCount": 101,
      "directDeps": 3,
      "transitiveDeps": 98,
      "licenses": {
        "MIT": 82,
        "unknown": 9,
        "BSD-3-Clause": 2,
        "ISC": 7,
        "BSD-2-Clause": 1
      },
      "toolVersion": "syft 1.42.1",
      "durationMs": 3002,
      "cdxPath": "C:\\Users\\scott\\Desktop\\Projects\\contract-pipeline\\pipeline\\data\\capabilities\\fidensa-mcp-server\\fidensa-mcp-server.cdx.json",
      "spdxPath": "C:\\Users\\scott\\Desktop\\Projects\\contract-pipeline\\pipeline\\data\\capabilities\\fidensa-mcp-server\\fidensa-mcp-server.spdx.json"
    },
    "cdxgen": {
      "componentCount": 169,
      "durationMs": 5767,
      "cdxgenPath": "C:\\Users\\scott\\Desktop\\Projects\\contract-pipeline\\pipeline\\data\\capabilities\\fidensa-mcp-server\\fidensa-mcp-server-cdxgen.cdx.json"
    }
  },
  "contract_supply_chain_sbom": {
    "format": "CycloneDX",
    "version": "1.5",
    "generated_at": "2026-03-29T17:50:17.624Z",
    "component_count": 101,
    "direct_dependencies": 3,
    "transitive_dependencies": 98,
    "vulnerability_summary": {
      "critical": 0,
      "high": 0,
      "medium": 0,
      "low": 0,
      "none": 0,
      "total": 0
    },
    "flagged_components": []
  }
}