No. 16 of 65 ·Software Composition Analysis Software

OWASP dep-scan

Windows · Mac · Linux · Self-hosted · API

Freedom report

Three barsScore 6.5

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely3 of 6 device platforms
DocumentedPlans, terms and facts published

OWASP dep-scan is ranked #16 of 65 in software composition analysis software on Freedom251. It runs on API, Linux, macOS, Self-hosted, Windows. There is a free plan.

OWASP dep-scan plans and pricing

All plans

OWASP dep-scan Free Free, open-source tool Fully open source · server mode and some extensions require the all package owasp.org · 7 Oct 2026

Compared on software composition analysis software

Free plan: Yes
Supported ecosystems: Node.js, Java/JVM, PHP, Python, Go, Ruby, Rust, .NET, Dart, Haskell, Elixir, C/C++, Clojure, Docker/OCI, GitHub Actions, Jenkins, YAML manifests
SBOM generation: Yes
Reachability analysis: Yes
Deployment options: self_hosted

Best OWASP dep-scan alternatives

See all 20

Two bars Snyk Open Source Free tier No. 1$25/mo6.7 Two bars Sonatype Nexus Repository Free tier No. 2$162.50/mo6.7 Two bars Accessibility Test Framework for Android Free tier No. 3Free6.6 Two bars Docker Desktop Free tier No. 4$9/mo6.6 Two bars Endor Labs Free tier No. 5Free6.6 Two bars OpenSCA Free tier No. 6Free6.6

The record

Purpose: Audits project dependencies, container images, and operating systems for known vulnerabilities, advisories, and license limitations.
Inputs: Supports local repositories, Linux container images, Kubernetes manifests, and operating systems.
Prioritization: Identifies known CVEs with prioritization to help users focus on findings that need attention.
Reachability: Provides reachability analysis across Java, JavaScript/TypeScript, Python, PHP, Rust, Go, and .NET.
Reports: Can generate SBOMs with Vulnerability Disclosure Report information and CSAF 2.0/2.1 VEX documents.
Vulnerability data: Lists OSV, NVD, GitHub, NPM, and Linux vulnerability data among its sources.
Integrations: Uses CycloneDX cdxgen to create SBOMs and documents integration with ORAS CLI and CI environments.
Local scanning: Package vulnerability scanning runs locally, and the project says it does not require a server for that mode.
Server and API: Can run as a self-hosted server with a /scan endpoint for scanning directories, SBOM files, and GitHub repositories.
Server security: The server refuses non-local binding unless an API key is configured or unauthenticated binding is explicitly enabled.
Platforms: The repository lists standalone binaries for Linux, macOS, and Windows, and also documents container use.
Notable limitation: The standalone macOS binaries are unsigned, so Gatekeeper may block them on first run.
Support: The project says developers can be reached through its Discord channel.
License and audience: The repository identifies the project as MIT licensed and describes it for dependency and container-image security and license audits.
Price from: Free

Where it ranks on Freedom251

Best Software Composition Analysis Software in 2026#16 of 65

Is OWASP dep-scan yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote OWASP dep-scan

Sources

owasp.github.io/www-project-dep-scan/· checked 7 Oct 2026
github.com/owasp-dep-scan/dep-scan· checked 7 Oct 2026
owasp.org/projects/dep-scan· checked 7 Oct 2026
owasp.org/blog/2023/10/05/appthreat-depscan-joins· checked 7 Oct 2026