No. 11 of 64 ·Software Composition Analysis Software

OSV-Scanner

Windows · Mac · Linux · Self-hosted

Freedom report

Three barsScore 6.5

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely3 of 6 device platforms
DocumentedPlans, terms and facts published

OSV-Scanner is ranked #11 of 64 in software composition analysis software on Freedom251. It runs on Linux, macOS, Self-hosted, Windows. There is a free plan.

OSV-Scanner plans and pricing

All plans

OSV-Scanner Free Open source scanner · CLI and Go library · SLSA3 compliant binaries google.github.io · 4 Oct 2026

Compared on software composition analysis software

Free plan: Yes
Supported ecosystems: C/C++, Dart, Elixir, Go, Haskell, Java, JavaScript, .NET, PHP, Python, R, Ruby, Rust; npm, pip, Maven, Go Modules, Cargo, Gem, Composer, NuGet
SBOM generation: Yes
Reachability analysis: Yes
Pull request scanning: Yes
Deployment options: self_hosted

Best OSV-Scanner alternatives

See all 12

Two bars Snyk Open Source Free tier No. 1$25/mo6.7 Two bars Sonatype Nexus Repository Free tier No. 2$162.50/mo6.7 Two bars Accessibility Test Framework for Android Free tier No. 3Free6.6 Two bars Docker Desktop Free tier No. 4$9/mo6.6 Two bars Endor Labs Free tier No. 5Free6.6 Two bars Socket Free tier No. 6$25/mo6.6

The record

Purpose: OSV-Scanner finds known vulnerabilities affecting a project's dependencies using the OSV database.
Ways to use: It can be run as a command-line tool or imported as a Go library.
Dependency coverage: It supports source scanning across ecosystems including C/C++, Go, Java, JavaScript, Python, Ruby, and Rust, with supported lockfiles and manifests listed in its documentation.
Container scanning: It scans container images for operating-system packages and language artifacts, including Alpine, Debian, Ubuntu, Go, Java, Node, and Python.
License scanning: It can check dependency licenses using deps.dev data and compare them with an allowed SPDX license list.
Offline mode: It can scan against a local OSV database without a network connection after the initial database download.
GitHub integration: Its GitHub Actions workflows support pull-request scans, scheduled full scans, and scans on release; the documentation says prebuilt workflows for other platforms are not currently offered.
Build provenance: The project offers SLSA3-compliant binaries for Linux, macOS, and Windows, and releases include SLSA provenance data for verification.
Data sent: The scanner sends package names, versions, ecosystems, and file hashes to the OSV.dev API; its README says no source code is transmitted to deps.dev.
Experimental remediation: Guided remediation suggests package version upgrades and is marked experimental; the README warns it can run package-manager scripts or follow external registries in untrusted projects.
Remediation coverage: The documented guided-remediation support covers npm package-lock.json and package.json, and Maven pom.xml.
Known limitations: Transitive dependency scanning is currently supported for Maven pom.xml, and test dependencies are not supported in its computed dependency graph.
Support: The project directs users to GitHub issues to report problems and accepts code contributions through its contribution guidelines.
Price from: Free

Where it ranks on Freedom251

Best Software Composition Analysis Software in 2026#11 of 64

Is OSV-Scanner yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote OSV-Scanner

Sources

google.github.io/osv-scanner/· checked 4 Oct 2026
google.github.io/osv-scanner/supported-languages-and-loc· checked 4 Oct 2026
github.com/google/osv-scanner· checked 4 Oct 2026
google.github.io/osv-scanner/usage/offline-mode/· checked 4 Oct 2026
google.github.io/osv-scanner/github-action/· checked 4 Oct 2026
google.github.io/osv-scanner/installation/· checked 4 Oct 2026