Show HN: Firmware GRC tool that generates OSCAL and SBOMs for 122 controls

Hey there HN! My name is James, and I'm the developer of Nabla. The journey building this was a massive learning experience and I'm still learning things about this market as I go, but I wanted to tell you a little bit about Nabla that I think excite me about the future and why I chose firmware as opposed to the normal cloud path for GRC.

It actually went through a weird three step journey. What started off as a general BCA tool I wanted to build just to challenge myself because I saw Fossa advertise it on their website, turned into a weird snowball of trying out different things with binary composition analysis.

I ended up realizing the our typed Rust struct which standardized the composition opened up the door to a lot of things I was wanting to do, and beginning to over-engineer before I dug in and looked at what was being extracted better. What we ended up with was a pretty nice CLI that can scan firmware of multiple types and produce machine readable compliance artifacts.

The CLI uses:

- goblin for parsing ELF, Mach-O, and PE formats - capstone for lightweight disassembly where needed - A custom BinaryAnalysis struct to normalize metadata - The BinaryAnalsis structured results are fed into an LLM, which maps findings to OSCAL controls

Right now it covers 122+ controls, but the control set is expanding. The LLM isn’t a black box here — it’s grounded by the structured analysis, so it doesn’t just hallucinate.

I’d love feedback on:

- Usability, once I publish docs (install/run experience)

- Accuracy of the OSCAL mappings

- Ideas for handling edge cases (firmware blobs, weird file formats)

Thanks, and happy to answer questions!