Metrics
Measured, not estimated.
Every number below was produced by running the engine or reading its own registries, and each one says which command or source produced it. Figures we could not measure are not rounded, inferred or softened into a range — they are listed further down as absent. There are no performance numbers on this page because we have not published a measurement harness for them yet.
Measured on 22 September 2026, on the current release candidate. Each figure is re-measured and pinned to the released commit when that release is tagged; a candidate’s commit may never reach the main line, so citing it would be a citation nobody could reproduce.
The six asked for most
Each of these fails the build if it drifts.
The floors carry a + because they are floors: a published floor may understate the engine, never overstate it, and the build fails the moment one does. The exact values behind the floors are in the table below.
Every figure, and how it was produced
The measurement, beside the number.
A number without its method is an opinion. Each row names the source of truth, so you can reproduce it from a checkout rather than take it from us.
| Figure | Value | How it was measured |
|---|---|---|
| Required runtime dependencies | 0 | The installed package declares no required dependency, so it needs Python and nothing else.Six optional extras exist for validation, signing, attestation, YAML and reachability, and none of them is needed to produce evidence. |
| Deterministic offline tests | 24,209 published as 24,200+ | Counted by the standard Python test runner across the full offline suite.A published floor is the round hundred just below the live count, derived rather than chosen so two people editing the site compute the same number. |
| Mandatory evidence artifacts | 14 | The artifacts an analysis run must write before it counts as complete — the same set sbomflow validate checks an output directory against.True of every successful analysis run. A run that stops early writes no output directory at all, and commands that are not analysis write no evidence pack — so this is not a claim about every invocation. |
| Stable, documented warning codes | 572 published as 500+ | Every warning the engine can raise, each with a stable code.Every code has an entry in the published warning reference, so the claim that carries weight — all of them documented — is exact and total even though the published figure is a floor. |
| Invocable CLI commands | 157 | Every command and subcommand the installed tool accepts: 87 top-level commands plus 70 subcommands across 15 command groups.Counted from the tool itself, not from a hand-kept list; sbomflow help prints the grouped command list. |
| Commands with no network-capable path | 147 of 157 | The network posture every command declares for itself.The remaining ten have an opt-in path, reachable only through one of the 12 declared egress gates — six named flags, one explicit invocation, and five configuration keys. The root help prints all of them. |
| Declared network egress gates | 12 | The declared list of ways the tool can reach a network, printed by the root help.Nothing reaches the network without passing one; there is no telemetry path to switch off. |
| Build and package families read in one run | 15 across 22 manifest formats | The distinct build and package families the engine accepts as input, as listed in the inputs reference and on embedded & container builds.Seven embedded and firmware build systems, six language ecosystems, containers and generic manifests. A new family cannot be added without being counted here. |
| Published artifact schemas | 41 5 stable, 36 experimental | sbomflow schema list.Stability is published per family rather than as an average, because an average would let an experimental artifact borrow a stable one’s credibility. |
| Custody verbs for runtime and test evidence | 8 | sbomflow custody --help: initialise, admit, list, show, verify, review, export, compare.All eight are offline; the help itself declares that this command has no network-capable path. |
| Artifacts a regime-neutral run writes | 25 of which 0 mention a regulation | A real analyze run of the bundled example with --requirement-regime none, counting top-level files in the output directory.The same example analysed under the CRA view writes 27, the two extra files being the CRA coverage map and its guidance crosswalk. Choosing no regime removes the regulatory content rather than emptying it. |
| Published jobs, and the steps in them | 8 jobs, 20 steps | The jobs published on the use-cases page, each recorded with the grade of evidence behind it.Every one of those grades is currently synthetic or open-source input, not customer data — which is why no job on this site claims a customer outcome. |
The verification pipeline behind these figures is public: Testing & trust explains what each lane proves and what it does not.
Not measured, so not claimed
The numbers that are missing, and why.
An absent figure is more useful than an invented one. These are the numbers a buyer reasonably wants that we cannot support today.
Speed and resource use
No runtime, throughput or memory figure appears anywhere on this site. We have not published a measurement harness, and a number without one is a marketing number. Runs are deterministic, which is a different property from fast.
Accuracy for the current build
The recorded adversarial-laboratory run on the accuracy scorecard was produced by an earlier build. No run for the current build is published, so no accuracy figure on this page describes it.
Adoption, customers and outcomes
No install count, no customer count, no logos, no case-study percentages. We are inviting the first design partners; publishing an adoption number now would mean inventing one.
A single assurance score
We built a frozen adversarial benchmark to score our own evidence handling and it publishes no score today, because no qualified independently re-verified receipt exists. How the score works →
Capability maturity is published per capability rather than as an overall readiness percentage — see the product record and the capability reference.
Check it yourself
None of this needs our permission to verify.
The figures above come from the engine you would run, not from a report about it. Once you have the tester build, the same two commands produce the same two numbers on your machine.
A run writes its own inventory of what it produced, so the artifact count is answerable without trusting this page, and the grouped command list and the list of published schemas answer for themselves — both offline, both from the build you hold.
$ sbomflow help
$ sbomflow schema listA figure on this page that disagrees with the engine is a defect, not a rounding. If you find one, tell us at hello@sbomflow.com and we will correct the page.