Solution · Software supply chain
SBOM & software-composition evidence
Turn software composition and provenance into evidence a buyer can actually review.
The SBOM solution organises software-component, dependency and provenance evidence around the software being supplied — an MCP server and the packages it ships in — so reviewers can see what is in scope and what changed between releases.
Prices and what can be bought today come from TrustOps, which owns every purchase, entitlement and renewal.
SBOM & software-composition evidence: fit, outcomes and contents
Best for
- MCP server and software publishers facing enterprise supply-chain review.
- Plugin, SDK, API and service teams managing third-party components.
- Organisations that want SBOM evidence tied to an enduring product identity rather than an isolated file.
What you get out of it
- More reviewable software-composition evidence.
- A clearer link between a release, its product identity and its supporting provenance.
- Less manual reconstruction of component evidence during customer or regulatory review.
What is included
- Structured software-composition evidence around the relevant ECZ-ID subject.
- Release and provenance context where supplied by the customer workflow.
- Support for buyer-facing evidence packaging.
- Managed and enterprise depth for larger programmes.
How it works
Identify the software product or service whose composition must be evidenced.
Collect the relevant composition and provenance inputs.
Organise them against the enduring ECZ-ID identity and release context.
Re-use and update the evidence as dependencies and releases change.
What it is not
- An SBOM describes composition and evidence; it is not a declaration that software is secure.
- ECZ-ID does not turn missing source evidence into verified facts.
Professional services it pairs with
MCP Readiness Audit
£395
- Paid in full at checkout
Stateless Migration Sprint
£1,950 total
- One-off engagement, paid in stages
- £1,170 due now, then 1 later milestone
TrustOps also names this engagement MCP Protocol Migration & Modernisation Sprint — the same engagement, bought as the Stateless Migration Sprint: £1,950 total. One-off engagement, paid in stages; £1,170 due now, then 1 later milestone.
Full scope, exclusions and deliverables
Price and availability
Prices and what can be bought today come from TrustOps, which owns every purchase, entitlement and renewal.