Freedom251 › Software Composition Analysis Software
OWASP dep-scan
What OWASP dep-scan is
OWASP dep-scan is a free, MIT-licensed tool for auditing dependencies, container images, and operating systems for vulnerabilities, advisories, and license limitations. It accepts local repositories, Linux container images, Kubernetes manifests, and operating systems, then prioritizes known CVEs. Reachability analysis covers Java, JavaScript and TypeScript, Python, PHP, Rust, Go, and .NET. dep-scan can generate SBOMs with Vulnerability Disclosure Report information and CSAF 2.0 or 2.1 VEX documents. Its vulnerability data includes OSV, NVD, GitHub, NPM, and Linux sources. Scanning can run locally without a server, or as a self-hosted server with a /scan endpoint for directories, SBOM files, and GitHub repositories. It supports API, Linux, macOS, Windows, and self-hosted use, plus integrations involving CycloneDX cdxgen, ORAS CLI, and CI environments.
Who it suits
It suits developers and security teams auditing software, containers, operating systems, and licenses across many ecosystems. Local and self-hosted deployment options support different operating models.
What it does well
- Free and MIT licensed
- Prioritizes known CVE findings
- Provides reachability analysis
- Generates SBOM and VEX documents
- Can scan locally without a server
What to know first
- Standalone macOS binaries are unsigned
- Gatekeeper may block first macOS run
- Server mode and some extensions require the all package
Limits
The free plan is listed as free. Server mode and some extensions require the all package.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| OWASP dep-scan | Free, open-source tool · Fully open source · server mode and some extensions require the all package | Free |
As owasp.github.io lists them, read 7 Oct 2026. The maker's own page has the final word.
Getting started
- Open the OWASP dep-scan website
- Choose API, Linux, macOS, Windows, or self-hosted deployment
- Provide a local repository, Linux container image, Kubernetes manifest, or operating system input
- Run package vulnerability scanning locally or configure the self-hosted server
- Use the /scan endpoint for directories, SBOM files, or GitHub repositories
Verdict
OWASP dep-scan covers dependency, container, operating-system, and license audits with local or self-hosted operation. Its unsigned macOS binaries and package requirements are practical considerations.
Questions
Is OWASP dep-scan free?
Yes. The listed OWASP dep-scan plan is free, and the project is MIT licensed.
Which platforms does it support?
It supports API, Linux, macOS, Windows, and self-hosted deployment.
Can scans run without a server?
Yes. Package vulnerability scanning can run locally without a server.
Does it generate SBOMs?
Yes. It can generate SBOMs with Vulnerability Disclosure Report information and CSAF 2.0 or 2.1 VEX documents.
What integrations are documented?
The project documents CycloneDX cdxgen, ORAS CLI, and CI environment integrations.
Facts from OWASP dep-scan's own pages
- Inputs
- Supports local repositories, Linux container images, Kubernetes manifests, and operating systems. · owasp.github.io, 7 Oct 2026
- Integrations
- Uses CycloneDX cdxgen to create SBOMs and documents integration with ORAS CLI and CI environments. · owasp.org, 7 Oct 2026
- License and audience
- The repository identifies the project as MIT licensed and describes it for dependency and container-image security and license audits. · github.com, 7 Oct 2026
- Local scanning
- Package vulnerability scanning runs locally, and the project says it does not require a server for that mode. · owasp.github.io, 7 Oct 2026
- Notable limitation
- The documented package risk audit mode currently supports npm and PyPI packages only. · owasp.github.io, 7 Oct 2026
- Platforms
- The repository lists standalone binaries for Linux, macOS, and Windows, and also documents container use. · github.com, 7 Oct 2026
- Prioritization
- Identifies known CVEs with prioritization to help users focus on findings that need attention. · github.com, 7 Oct 2026
- Purpose
- Audits project dependencies, container images, and operating systems for known vulnerabilities, advisories, and license limitations. · owasp.github.io, 7 Oct 2026
- Reachability
- Provides reachability analysis across Java, JavaScript/TypeScript, Python, PHP, Rust, Go, and .NET. · github.com, 7 Oct 2026
- Reports
- Can generate SBOMs with Vulnerability Disclosure Report information and CSAF 2.0/2.1 VEX documents. · github.com, 7 Oct 2026
- Server and API
- Can run as a self-hosted server with a /scan endpoint for scanning directories, SBOM files, and GitHub repositories. · github.com, 7 Oct 2026
- Server security
- The server refuses non-local binding unless an API key is configured or unauthenticated binding is explicitly enabled. · github.com, 7 Oct 2026
- Support
- The project says developers can be reached through its Discord channel. · owasp.org, 7 Oct 2026
- Vulnerability data
- Lists OSV, NVD, GitHub, NPM, and Linux vulnerability data among its sources. · owasp.github.io, 7 Oct 2026