For scanning your project’s dependencies for known vulnerabilities without signing up for a hosted service, start with OSV-Scanner. It is a command-line tool and Go library that matches your project’s dependencies against OSV vulnerability data, and it can run locally. Trivy is the better choice when your scope extends to container images, operating-system packages, or Kubernetes components. GitHub Dependabot solves a different problem: it automates dependency updates inside a repository rather than acting as a local scanner. Lockhawk is worth a look only if your work is limited to npm, and its no-account claim should be checked against its current state before you rely on it.
The phrase “anonymous” needs a precise meaning before you choose a tool, and the rest of this article works through it.
As an Amazon Associate I earn from qualifying purchases.
Why “free” and “anonymous” are separate requirements
A tool can be free and still require an account, and a tool can avoid accounts while still sending requests over the network. Snyk’s hosted platform is built around signing in to an organization, which is the workflow most readers want to get away from. Dropping that account does not, by itself, make a scan private. A local scanner that downloads advisory data, or that queries a vulnerability database for each package, has no vendor account but still makes network requests. When you evaluate an option, check three things separately: whether you need to create an account, whether an API key or token is required, and where the scan actually executes and what data leaves your machine.
The shortlist
Four tools come up for this use case. They overlap less than their names suggest, so the question to ask first is which kind of problem you are solving.
#1 Best Overall
OSV-Scanner: the local dependency scanner
OSV-Scanner is the most direct answer to the reader’s question. The project documents it as a CLI and Go library that uses OSV data to find existing vulnerabilities affecting a project’s dependencies. Its source scanning guide describes how to point it at a project directory and its lockfiles or manifests.
Offline operation is documented. OSV-Scanner can scan against a local copy of the vulnerability database. That copy has to be downloaded first, so the first setup does involve network access. After that, the documented offline mode does not depend on a live connection. Do not describe it as zero-network from installation onward unless you have verified that in your own environment.
Trivy: broader surface, wider scope
Trivy is the option to consider when dependency files are only one part of the job. Its vulnerability scanning documentation covers operating-system packages, language-specific packages, software that was not installed through a package manager, and Kubernetes components. The same documentation notes coverage limitations for some third-party OS package repositories, so confirm that your distribution and package sources are included before assuming full coverage.
Trivy’s wider reach brings more to read and configure. If you only need to check a Node or Python project’s lockfile, a narrower tool is usually simpler to run in CI.
GitHub Dependabot: updates, not local scanning
Dependabot is configured through a dependabot.yml file in a repository. That file controls how often automated update checks run, which ecosystems are covered, and how many pull requests may be open at once. Dependabot is part of GitHub’s repository workflow, so it assumes a GitHub-hosted repository and a GitHub account with access to it.
Because it proposes version updates through pull requests, Dependabot is complementary to a scanner rather than a replacement for one. A scanner tells you what is vulnerable; an update tool helps you move off the vulnerable version. The documentation for dependabot.yml describes update behavior, not parity with a local vulnerability scanner, so do not treat it as an anonymous alternative to Snyk’s scanning features.
Lockhawk: npm-focused, verify before adopting
Lockhawk is a project aimed at npm lockfile scanning. Its maintainers state on the project page that no account or API key is required, and they describe scanning that draws on OSV.dev data. These are the maintainers’ claims, not independently verified facts. Check the repository’s current release state, the lockfile versions it supports, and whether its data source behaves as described before putting it into a pipeline. Its scope is npm; it is not a general answer for multi-ecosystem projects.
Side-by-side comparison
| Option | Best fit | Account and workflow | Coverage caveat |
|---|---|---|---|
| OSV-Scanner | Local CLI or Go library scanning of project dependencies against OSV data | Offline mode is documented after a local database is obtained; the project documentation does not establish zero network traffic in every setup | Confirm the package ecosystem, project file type, and the analysis features you need against the current docs; the README describes the latest V2 beta instructions |
| Trivy | Dependencies plus OS packages, container targets, non-packaged software, and Kubernetes components | Documentation describes scanner capability; it does not establish anonymous use in every integration | Some third-party OS package repositories may not be covered |
| GitHub Dependabot | Automated dependency update pull requests in a repository | Runs within a GitHub repository; account prerequisites for each feature are not resolved on the cited configuration page | Covers dependabot.yml behavior, not parity with a local vulnerability scanner |
| Lockhawk | npm lockfile vulnerability scanning | Maintainers claim no account or API key is needed; not independently verified | npm-focused; do not generalize to other ecosystems |
Sources for the table: OSV-Scanner, OSV-Scanner README, Trivy vulnerability scanning, Dependabot configuration, and Lockhawk.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.No tool is a drop-in Snyk replacement
None of these options has been shown to match Snyk feature for feature. Snyk combines dependency scanning with code analysis, container checks, infrastructure scanning, and a hosted dashboard, and the tools above cover different parts of that. Treat any claim of full parity as unproven until you have compared the options on your own repositories. The project documentation establishes what each tool is designed to do; it does not establish how their advisory data, transitive dependency handling, or remediation guidance compare in practice.
How to choose
Work through these questions in order. Each answer narrows the field.
- Which ecosystems are in your repositories? If everything is npm, Lockhawk and OSV-Scanner are both candidates. If you have mixed ecosystems, start with OSV-Scanner or Trivy.
- Do you need container images, OS packages, or Kubernetes checks? If yes, Trivy is the broader fit. If no, OSV-Scanner keeps the scope smaller.
- Where must the scan run? A local CLI keeps the work on your machine, but the first database download and any advisory lookups still touch the network. If the scan must never leave a restricted network, plan the database download as a separate, approved step.
- Do you need automatic fixes proposed? If yes, pair a scanner with Dependabot or a similar update tool in a GitHub-hosted repository.
- Does your CI need transitive dependency analysis and remediation guidance? Check each candidate’s documentation for those features, because the sources above do not establish parity on them.
- Is anonymity a hard requirement? Confirm that no account, token, or telemetry is required for the exact command and integration you plan to use, and test that in a controlled environment.
Bottom line on “anonymous”
For most teams the practical answer is a local scanner with no vendor account: OSV-Scanner for dependency-focused work across ecosystems, Trivy when the scope is wider, Dependabot alongside either for update pull requests, and Lockhawk only for npm after you verify it. Describe the result as account-free and local-first, not as fully anonymous, unless your own testing shows no network activity beyond what you expect.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
