{
  "stage": "stage2a-sbom",
  "generated_at": "2026-03-28T21:09:42.728Z",
  "sbom_generation": {
    "syft": {
      "componentCount": 32,
      "directDeps": 9,
      "transitiveDeps": 23,
      "licenses": {
        "unknown": 31,
        "BSD-3-Clause": 1
      },
      "toolVersion": "syft 1.42.1",
      "durationMs": 4424,
      "cdxPath": "C:\\Users\\scott\\Desktop\\Projects\\contract-pipeline\\pipeline\\data\\capabilities\\mark3labs-filesystem-server\\mark3labs-filesystem-server.cdx.json",
      "spdxPath": "C:\\Users\\scott\\Desktop\\Projects\\contract-pipeline\\pipeline\\data\\capabilities\\mark3labs-filesystem-server\\mark3labs-filesystem-server.spdx.json"
    },
    "cdxgen": {
      "componentCount": 14,
      "durationMs": 9510,
      "cdxgenPath": "C:\\Users\\scott\\Desktop\\Projects\\contract-pipeline\\pipeline\\data\\capabilities\\mark3labs-filesystem-server\\mark3labs-filesystem-server-cdxgen.cdx.json"
    }
  },
  "contract_supply_chain_sbom": {
    "format": "CycloneDX",
    "version": "1.5",
    "generated_at": "2026-03-28T21:09:42.728Z",
    "component_count": 32,
    "direct_dependencies": 9,
    "transitive_dependencies": 23,
    "vulnerability_summary": {
      "critical": 0,
      "high": 0,
      "medium": 0,
      "low": 2,
      "none": 0,
      "total": 2
    },
    "flagged_components": [
      {
        "name": "golang.org/x/net",
        "version": "v0.39.0",
        "vulnerability": "CVE-2025-47911",
        "severity": "low",
        "status": "patched",
        "notes": "found by: osv-scanner; fix: 0.45.0"
      },
      {
        "name": "golang.org/x/net",
        "version": "v0.39.0",
        "vulnerability": "CVE-2025-58190",
        "severity": "low",
        "status": "patched",
        "notes": "found by: osv-scanner; fix: 0.45.0"
      }
    ]
  }
}