package mql.sbomscan.v1

Get desktop application:
View/edit binary Protocol Buffers messages

ScanUploadedSbom scans an SBOM for vulnerabilities scoped to a space. It is ephemeral: the server returns the VEX results without storing anything. The caller uploads the returned VEX itself (via the findings-upload path) when reporting to the platform. Wire-compatible with mondoo.policy ExtendedVulnMgmt.ScanUploadedSbom.

• rpc ScanUploadedSbom (ScanUploadedSbomRequest, ScanUploadedSbomResponse)

  vulnscan.proto:29

  message ScanUploadedSbomRequest

  vulnscan.proto:33

  • string asset_mrn = 1

    The MRN to scope the scan to (field 1 on the server). Clients pass a space MRN; the field keeps the server's historical name asset_mrn for wire/JSON compatibility (the server resolves an asset/org MRN to its space too).

  • optional mondoo.sbom.v1.Sbom sbom = 2

    The SBOM to scan (field 2 on the server).

  message ScanUploadedSbomResponse

  vulnscan.proto:42

  • repeated fex.v1.VulnerabilityExchange vex = 2

    Field 1 on the server is page info; intentionally omitted here. The vulnerabilities found, as VEX documents.