Open Source Cryptographic Bill of MaterialsInstant. Complete. Enterprise Ready.
Scan any codebase in seconds. Detect every algorithm, key, and certificate. Block deprecated crypto before it merges. Self-host or cloud.
$ brew install keylens/tap/cbomBuilt for Speed and Compliance
Everything you need to inventory, enforce, and report on cryptographic usage.
Lightning Fast
Rust-native binary scans 20+ languages in milliseconds. No JVM, no Docker, no waiting.
Learn →Any Language
Tree-sitter AST parsing detects cryptographic usage in any language — Rust, Go, Python, Java, TypeScript, and more.
Learn →CI/CD Gating
Rego policy enforcement in GitHub Actions. Auto-block deprecated cryptography before it merges.
Learn →CBOM Output
CycloneDX 1.6 standard format. Machine-readable, auditor-ready, CI/CD-integrated.
Learn →CNSA 2.0 Rules
Built-in compliance checks for CNSA 2.0, EO 14412, and NIST PQC standards. Ready out of the box.
Learn →Zero Setup
Single ~15MB binary. brew install and scan. No Docker, no JDK, no configuration files.
Learn →Why KeyLens?
Side-by-side with CBOMkit — the only other open source CBOM tool.
| Feature |  KeyLens | CBOMkit |
|---|---|---|
| Scan engine | Rust (native binary) | Java (JVM/Docker) |
| Languages | 20+ (Tree-sitter AST) | Java + Python only |
| Time to scan 10K LOC | ~300ms | ~8-12s |
| Install | brew install | Docker + JDK 21 |
| CI/CD integration | Native GitHub Action | Docker-based |
| Policy engine | Rego (built-in) | Limited built-in |
| CBOM diff (CI gating) | Yes | No |
| Air-gapped deploy | Yes | No |
| SSO/SAML | Yes | No |
| License | MPL-2.0 | MIT |
See It in Action
From quick scans to full CI/CD gating in minutes.
# Scan your codebase
$ cbom scan .
# Filter by algorithm family
$ cbom scan . --filter 'algo.family=="SHA"'
# Output as CBOM (CycloneDX 1.6)
$ cbom scan . --format cbom --output report.json
# Export for auditor
$ cbom scan . --format pdf > crypto-inventory.pdfname: Crypto Gate
on: [pull_request]
jobs:
cbom-check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run KeyLens CBOM scan
uses: keylens/cbom-action@v1
with:
policy: cnsa-2.0
fail-on: deprecated
output: cbom-report.json
- name: CBOM Diff (block regressions)
uses: keylens/cbom-action@v1
with:
command: diff
baseline: mainpackage keylens.policy
# Block SHA-1 in all codebases
deny[msg] {
input.algorithm.name == "SHA-1"
msg := sprintf(
"SHA-1 detected in %s — migrate to SHA-256+",
[input.location.file]
)
}
# Require PQC for key exchange
deny[msg] {
input.algorithm.primitive == "KEM"
not startswith(input.algorithm.name, "ML-KEM")
msg := sprintf(
"Non-PQC KEM '%s' in %s — use ML-KEM",
[input.algorithm.name, input.location.file]
)
}Covered by KeyLens
Before KeyLens
- Manual inventory in spreadsheets
- 3-6 week audit cycles
- $200k+ in consulting fees
- Results stale on delivery
After KeyLens
cbom scan .- Results in under 2 minutes
- Auditor-ready CBOM output
- Continuous, automated, free
Open Source Community
Built in the open. Trusted by security teams worldwide.