Inventory
Components, dependencies, and licenses across your projects.
Once a BOM is parsed, its contents become a searchable inventory you can explore at the project and organization level.
Components
The Components view lists every package and part across your BOMs, with the projects and versions where each appears. Use it to answer "where do we use this package?" in seconds — essential when a new advisory drops.
Open a component to see its versions, the BOMs it came from, associated vulnerabilities, and any component overrides you've applied (for example, to correct or annotate metadata that a generator got wrong).
| Type | License | Vulnerabilities | ||
|---|---|---|---|---|
| react18.2.0 | npm | 11 | MIT | — |
| lodash4.17.11 | npm | 9 | MIT | H11 |
| express4.16.2 | npm | 7 | MIT | H11 |
| axios0.21.1 | npm | 6 | MIT | M11 |
| jsonwebtoken0.4.0 | npm | 4 | MIT | C11 |
| jquery2.2.4 | npm | 3 | MIT | M11 |
| vm23.9.5 | npm | 2 | MIT | C11 |
| guava30.1-jre | maven | 2 | Apache-2.0 | L1 |
Dependencies
Dependencies capture the relationships between components — direct vs. transitive, and who pulls in what. This is what lets TraceGuard tell you whether a vulnerable package is something you depend on directly or inherited several layers down.
Licenses
The Licenses view aggregates the licenses found across your components, so you can spot copyleft or unknown-license obligations. Open a license to see exactly which components carry it.
Inventory is read-through from your BOMs: upload a newer BOM and the inventory updates. Per-org data like overrides and decisions lives separately from the shared component records.
Next
Vulnerabilities & scanning turns this inventory into prioritized risk.