No. 10 of 22 ·SBOM Management Software

TRUSCA

Web · Linux · Self-hosted · API

Freedom report

Two barsScore 6.4

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely2 of 6 device platforms
DocumentedPlans, terms and facts published

TRUSCA is ranked #10 of 22 in SBOM management software on Freedom251. It runs on API, Linux, Self-hosted, Web. There is a free plan.

TRUSCA plans and pricing

All plans

Apache-2.0 self-hosted Free No per-seat licensing · self-hosted deployment trustedoss.github.io · 3 Oct 2026

Compared on SBOM management software

SBOM standard support: both
Deployment model: self_hosted
Vulnerability analysis: Yes
License analysis: Yes
Policy enforcement: Yes
SBOM exchange: Yes

Best TRUSCA alternatives

See all 12

Two bars Sonatype Nexus Repository Free tier No. 1$162.50/mo6.7 Two bars Interlynk Free tier No. 2Free6.6 Two bars sbomify Free tier No. 3$159/mo6.6 One bar CAST SBOM Manager Free tier No. 4Free6.4 One bar Exodos Labs Free tier No. 5$29/mo6.4 One bar FOSSA Free tier No. 6$168392.50/mo6.4

The record

Purpose: TRUSCA is a self-hosted software composition analysis platform for CVE tracking, license compliance, and SBOM management.
Component detection: It uses cdxgen to detect packages across 30+ language ecosystems.
Vulnerability feeds: Trivy matches components against NVD, OSV, GitHub Advisory, EPSS, and KEV data, with new CVEs picked up on weekly database refreshes.
SBOM: TRUSCA exports CycloneDX in JSON or XML and SPDX in JSON or Tag-Value, and can ingest CycloneDX or SPDX SBOMs.
CI integrations: The project documents a GitHub Action, GitLab CI template, Jenkinsfile example, REST API, and API keys; its build gate can fail on a Critical CVE or forbidden license.
License workflow: Licenses are classified as allowed, conditional, or forbidden, with NOTICE file generation and build blocking for forbidden licenses.
Notifications and audit: Workflow features include component approval, an append-only audit log, and notifications via email, Slack, and Teams.
Security triage: TRUSCA provides a seven-state CycloneDX VEX triage workflow and EPSS prioritization.
Not a SAST scanner: The documentation says TRUSCA does not analyze users’ own source code and focuses on third-party components.
Deployment: TRUSCA is distributed for users to run themselves with Docker Compose or a Helm chart; a read-only live demo is also available.
Language support: The UI, error messages, and documentation are available in English and Korean.
Support: The project says it has no paid support tier or managed hosting and directs users to its community support channels.
Intended users: The project describes the portal as serving engineering, legal, and security teams.
Price from: Free

Where it ranks on Freedom251

Best SBOM Management Software in 2026#10 of 22

Is TRUSCA yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote TRUSCA

Sources

trustedoss.github.io/trusca/docs/intro· checked 3 Oct 2026
trustedoss.github.io/trusca/· checked 3 Oct 2026
github.com/trustedoss/trusca/blob/main/SUPPORT.md· checked 3 Oct 2026