Trace-AI

What Trace-AI is

Trace-AI is a supply chain security tool. It produces real-time SBOMs from your repositories, scores risk with exploit awareness rather than raw CVE counts, checks licence compliance and tracks vendor context such as APIs, SDKs and SLA status.

The site states the first repositories are free.

What you can do with it

• Generate CycloneDX or SPDX SBOMs
• Prioritise vulnerabilities by exploitability
• Check dependency licences
• Watch third-party vendor exposure

Who it is for

• Development and security teams
• Organisations needing SBOM evidence
• Teams managing supply chain compliance

What to watch out for

• SBOM output is evidence, not a guarantee that dependencies are safe
• Exploitability scoring should be checked against your own context and threat model
• Repository scanning means granting code access; scope it
• Confirm current free limits and pricing