No. 24 of 65 ·Software Composition Analysis Software

OpenSCA

Web · Windows · Mac · Linux · Self-hosted · Extension

Freedom report

Two barsScore 5.3

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely4 of 6 device platforms
DocumentedThinly documented

OpenSCA is ranked #24 of 65 in software composition analysis software on Freedom251. It runs on Browser extension, Linux, macOS, Self-hosted, Web, Windows. There is a free plan.

OpenSCA plans and pricing

All plans

OpenSCA Free Online and offline use stated; no other plan limits stated opensca.xmirror.cn · 5 Oct 2026

Compared on software composition analysis software

Free plan: Yes
Supported ecosystems: Java/Maven, Java/Gradle, JavaScript/NPM, PHP/Composer, Ruby/gem, Golang/Go mod, Rust/cargo, Erlang/Rebar, Python/Pip
SBOM generation: Yes
Pull request scanning: Yes
Deployment options: hybrid

Best OpenSCA alternatives

See all 20

Two bars Snyk Open Source Free tier No. 1$25/mo6.7 Two bars Sonatype Nexus Repository Free tier No. 2$162.50/mo6.7 Two bars Accessibility Test Framework for Android Free tier No. 3Free6.6 Two bars Docker Desktop Free tier No. 4$9/mo6.6 Two bars Endor Labs Free tier No. 5Free6.6 Two bars Socket Free tier No. 6$25/mo6.6

The record

Purpose: OpenSCA analyzes software components and dependencies to identify vulnerabilities and open-source license risks.
SBOM: It generates SBOMs in DSDX, SPDX, CycloneDX, and SWID formats, and can take an SBOM as input to produce a vulnerability report or convert it to another format.
Interfaces: The maker describes use through an IDE, command line, or cloud platform, with online and offline scenarios.
IDE integrations: The documentation provides OpenSCA Xcheck plugins for IntelliJ IDEA and VS Code.
Operating systems: The CLI is available for Windows, Linux, and macOS.
Language coverage: The documented package ecosystems include Maven and Gradle for Java, npm, Composer, Ruby gems, Go modules, pip, Cargo, and Rebar.
Vulnerability data: The CLI documentation says its cloud vulnerability database covers CVE, CWE, NVD, CNVD, and CNNVD, and it also supports a configurable local vulnerability database.
Custom databases: The product documentation says users can configure vulnerability databases and private package repositories.
Report formats: The CLI supports JSON, XML, HTML, SQLite, CSV, and SARIF reports, alongside several SBOM formats.
Scanning limitation: Parsing requirements.txt and requirements.in requires a pipenv environment and an internet connection, according to the language support page.
Scan-time factors: The maker says scanning time depends on package size, network conditions, and programming language.
Support: The project invites issues and lists [email protected] and QQ group 832039395 for contact.
License: The OpenSCA-cli repository identifies its license as Apache-2.0.
Intended users: The maker describes the solution as serving enterprises, organizations, and individual users.
Price from: Free

Where it ranks on Freedom251

Best Software Composition Analysis Software in 2026#24 of 65

Is OpenSCA yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote OpenSCA

Sources

opensca.xmirror.cn/docs/v1/· checked 5 Oct 2026
opensca.xmirror.cn/docs/v1/sbom.html· checked 5 Oct 2026
opensca.xmirror.cn/docs/v1/idea.html· checked 5 Oct 2026
github.com/XmirrorSecurity/OpenSCA-cli· checked 5 Oct 2026
opensca.xmirror.cn/docs/v1/language.html· checked 5 Oct 2026
opensca.xmirror.cn· checked 28 Sept 2026