GUAC

GUAC is an open-source software supply-chain analysis tool for teams that need to connect software metadata across multiple projects. It is best suited to developers, operations and security practitioners, and Open Source Program Offices managing a portfolio rather than a single SBOM. Its breadth of analysis comes with an operational trade-off: deployment has Docker prerequisites, and most collectors are experimental.

Overview

GUAC ingests SBOMs and related metadata, maps relationships between software, and makes the resulting graph queryable. That portfolio-wide view helps teams look for vulnerable, deprecated, unsupported or duplicated dependencies across projects, and investigate risky upstreams using OpenSSF Scorecard. It is a better fit for organizations that need connected analysis than for teams whose needs stop at reviewing one SBOM at a time.

GUAC supports SPDX and CycloneDX SBOMs. Stable enrichment sources add vulnerability data from OSV, license information from ClearlyDefined and dependency information from Deps.dev. These enrichments make the graph more useful for investigation, though they do not remove the work of collecting and operating the underlying data pipeline.

Key features

Portfolio graph, APIs and visualization

GUAC aggregates software relationships into a queryable portfolio view, with APIs and a visualization tool for exploring the data. That combination is useful when different practitioners need to investigate dependencies or upstream risk across many projects; it is less compelling for teams looking for a narrowly scoped SBOM viewer.

Collection and storage

Collectors can read or watch files, storage buckets and Git repositories, but only the filesystem collector is stable; the others are experimental. Organizations depending on bucket or repository collection should account for that maturity gap. The GraphQL server can use an in-memory backend or PostgreSQL for persistent storage, allowing a choice between transient data and persistence.

Deployment and project

The setup guide starts the server with Docker Compose and requires Docker, Docker Compose and jq. GUAC provides CLI binaries for Linux x86_64, macOS ARM64 and Windows x86_64. It is an OpenSSF Incubating Project in the Supply Chain Integrity Working Group. Its code uses the MIT license, while documentation content uses CC BY 4.0.

Pricing

GUAC is free and open source. The GUAC open-source project plan costs nothing and includes code under the MIT license; it does not eliminate the setup requirement for Docker, Docker Compose and jq. There are no paid tiers to compare, so the main cost to weigh is the effort of self-hosting and managing collection, storage and analysis.

Platforms

GUAC supports API, Linux, macOS, self-hosted, web and Windows. Its published CLI binaries cover Linux x86_64, macOS ARM64 and Windows x86_64; the setup path uses Docker Compose. Teams should distinguish that binary coverage from the broader platform list when planning deployment.

Who it's for

GUAC suits developers, operations and security practitioners, along with Open Source Program Offices, that need to trace dependencies and upstream relationships across a software portfolio. It is particularly relevant where teams need to identify recurring dependency problems or risky upstreams. It is not the best choice for organizations that want a mature, low-setup collection workflow, given the Docker prerequisites and experimental status of most collectors.

Pros and cons

• Pros: Portfolio-level analysis connects data across software instead of isolating each SBOM, helping teams find dependency issues that span projects.
• Pros: SPDX and CycloneDX support, stable OSV, ClearlyDefined and Deps.dev enrichments, and APIs plus visualization provide multiple ways to build and explore supply-chain context.
• Pros: The project is free and open source under MIT, with an option for persistent PostgreSQL storage.
• Cons: Docker, Docker Compose and jq are setup prerequisites, which add an operational hurdle for teams seeking a ready-to-use service.
• Cons: Only the filesystem collector is stable; teams relying on storage bucket or Git collection must accept experimental components.

Alternatives

For a broader comparison, see Software Supply Chain Security Software.

• ActiveState Platform is worth considering for teams that want a freemium option with a free organization plan limited to public projects, rather than GUAC's open-source project model.
• Sonatype Nexus Repository may suit teams seeking a repository-focused option with a free Community Edition that includes full ecosystem support, CI/CD integration and an external PostgreSQL option.
• Wisec is an alternative for teams that prefer a freemium plan with defined project, build, history and certificate limits: its free tier allows 3 projects, 1,000 builds/month, 30 days of history and 1 PDF certificate/month.
• DevGuard is another freemium option for readers comparing supply-chain security platforms.
• SafeDep Platform may appeal to readers who want free open-source tools such as Vet, PMG, xBom and Gryph that can be used without a SafeDep account.
• StepSecurity is a possible alternative for teams focused on public GitHub repositories; its free Community plan includes unlimited public repositories and GitHub-hosted runners on GitHub Cloud.
• Chainloop offers a free, open-source, self-hosted Community Edition, but it has no UI or curated policy library.
• Sigstore is a neutral alternative for readers evaluating other free software supply-chain tools.

Verdict

Choose GUAC if your organization needs a free, open-source way to connect SBOMs and related metadata for portfolio-level supply-chain analysis, and can operate a Docker-based deployment. Look elsewhere if stable collection across buckets or Git repositories is central to your workflow, or if you want a solution without the setup and collector-maturity trade-offs.