Freedom251 › Software Composition Analysis Software
ts-scan
What ts-scan is
ts-scan is a free, open-source command-line scanner for software composition analysis in CI/CD pipelines. It examines native lockfiles and build configurations to identify direct and transitive dependencies, then creates software bills of materials in SPDX or CycloneDX formats. The scanner supports more than 20 build systems, including Maven, Gradle, npm, PyPI, NuGet, Composer, Go Modules, Cargo, and CocoaPods, with ecosystems covering languages and package tools such as C, C++, C#, Rust, Go, Python, Java, JavaScript, TypeScript, Swift, and Docker. TrustSource documents integrations with GitHub Actions, GitLab CI, and Jenkins. Results can move through a documented REST API to TrustSource or other tooling. Uploaded SBOMs can be checked against vulnerability databases, license policies, and regulatory requirements on the TrustSource platform. Installation is documented through pip, with Docker images and source builds available in the repository. It runs on Linux, macOS, Windows, API, or self-hosted deployments and uses the Apache-2.0 license.
Who it suits
ts-scan suits development and security teams automating dependency analysis and SBOM generation in CI/CD pipelines. Its self-hosted and command-line options fit teams managing their own environments.
What it does well
- Free and open source
- Supports over 20 build systems
- Exports SPDX and CycloneDX SBOMs
- Integrates with GitHub, GitLab, and Jenkins
- Runs on Linux, macOS, and Windows
What to know first
- No reachability analysis
- No pull request scanning
- Package-script behavior changed from version 1.5.2
Verdict
ts-scan focuses on dependency discovery and SBOM production across many ecosystems. Teams needing reachability or pull-request scans will not find those capabilities listed.
Facts from ts-scan's own pages
- Analysis
- It analyzes native lockfiles and build configurations to identify dependencies without additional configuration. · trustsource.io, 9 Oct 2026
- API
- The product page says results can flow through a documented REST API to TrustSource or other tooling. · trustsource.io, 9 Oct 2026
- Backend
- Scan results can be sent through a documented REST API to the TrustSource platform or other tooling. · trustsource.io, 9 Oct 2026
- CI/CD integration
- The maker says ts-scan integrates into GitHub workflows as a GitHub Action. · trustsource.io, 9 Oct 2026
- CI integration
- The product page says ts-scan integrates with GitHub workflows through a GitHub Action. · trustsource.io, 9 Oct 2026
- Community support
- The documentation directs community users to file repository tickets and says TrustSource subscribers can contact TrustSource support. · trustsource.github.io, 9 Oct 2026
- Company
- TrustSource identifies itself as a brand of EACG GmbH. · trustsource.io, 9 Oct 2026
- Dependency analysis
- ts-scan analyzes native lockfiles and build configurations to find direct and transitive dependencies. · trustsource.io, 9 Oct 2026
- Dependency coverage
- The product page says ts-scan supports more than 20 build systems, including Maven, Gradle, npm, PyPI, NuGet, Composer, Go Modules, Cargo and CocoaPods. · trustsource.io, 9 Oct 2026
- Headquarters
- Frankfurt am Main, Germany · trustsource.io, 28 Sept 2026
- Installation
- The maker documents installation with pip and says Docker images and source builds are available in the repository. · trustsource.io, 9 Oct 2026
- Intended users
- The maker describes ts-scan as an open-source CLI scanner for use in CI/CD pipelines to identify dependencies and create SBOMs. · trustsource.io, 9 Oct 2026
- License
- The repository identifies ts-scan as Python software under the Apache-2.0 license. · github.com, 9 Oct 2026
- Maker
- TrustSource is a brand of EACG GmbH; the site operator is EACG Operations Services GmbH, located in Frankfurt am Main, Germany. · trustsource.io, 9 Oct 2026
- Open source
- The scanner is open source and its GitHub repository identifies the license as Apache-2.0. · github.com, 9 Oct 2026
- Other CI integrations
- TrustSource says ts-scan integrates with GitHub Actions, GitLab CI and Jenkins. · trustsource.io, 9 Oct 2026
- Purpose
- ts-scan scans software dependencies and generates a software bill of materials (SBOM). · trustsource.io, 9 Oct 2026
- SBOM formats
- It exports SBOMs in SPDX and CycloneDX formats. · trustsource.io, 9 Oct 2026
- Security and policy checks
- Uploaded SBOMs can be checked on the TrustSource platform against vulnerability databases, license policies and regulatory requirements. · trustsource.io, 9 Oct 2026
- Security behavior
- The maker says that from version 1.5.2, ts-scan no longer executes package.json lifecycle scripts by default and instead warns about the configuration. · trustsource.io, 9 Oct 2026
- Supported build systems
- The product page lists support for more than 20 build systems, including Maven, Gradle, npm, PyPI, NuGet, Composer, Go Modules, Cargo, and CocoaPods. · trustsource.io, 9 Oct 2026
- Supported ecosystems
- The maker's SCA page lists ecosystems and package managers including C, C++, C#, Rust, Go, Python, Java, JavaScript, TypeScript, Swift, Maven, NuGet, Gradle, npm, Composer, Cargo and Docker. · trustsource.io, 9 Oct 2026
- Target audience
- The maker describes ts-scan as an open-source scanner for automating software composition analysis in CI/CD pipelines. · trustsource.io, 9 Oct 2026