Free and open first

Best Software Composition Analysis Software in 2026

Reviewing software components and dependencies can involve different coverage and scanning approaches. Compared on supported ecosystems, monitored projects and deployment options, these entries also specify pull request scanning, reachability analysis and SBOM generation. Consider which ecosystems your projects use and how the listed capabilities fit your development process. Free-plan availability and paid-from pricing provide additional comparison points. Snyk Open Source, Sonatype Nexus Repository and Endor Labs are among the options, alongside Socket, Trivy and Xygeni.

65 apps
Research read 23 Sept 2026
How the order is worked out

1

DeepFilterNet

Free plan Open source APILinuxMac+2

DeepFilterNet offers command-line and real-time noise suppression, with a 48 kHz constraint and additional plugin latency to consider. Its training workflow is tested only on Linux.

9.2 Open source Visit site
2

Grype

Free plan Open source LinuxMacSelf-hosted+1

Grype covers a broad range of scan targets and package ecosystems, with several output formats and vulnerability prioritization options.

9.0 Free plan Visit site
3

Bomly CLI

Free plan APILinuxMac+1

Choose Bomly CLI if you want a free local or CI tool for dependency graphs, SBOM work, or pull request scanning.

7.7 Free plan Visit site
4

Clair

Free plan APILinuxSelf-hosted

Choose Clair if you need a free, self-hosted way to scan container images and match findings against known vulnerabilities.

7.5 Free plan Visit site
5

ComplyVigilance SCA

Free plan APISelf-hostedWeb

ComplyVigilance SCA covers dependency and container analysis, SBOMs, and compliance workflows, with capabilities varying by tier.

7.5 Pricing on request Visit site
6

DepWarden

Free plan APILinuxMac+3

DepWarden combines dependency analysis, prioritization, SBOM handling, and repository integrations across a broad ecosystem list.

7.5 Free plan Visit site
7

Eclipse Steady

Free plan APILinuxMac+2

Eclipse Steady provides code-focused vulnerability assessment workflows for Java and Python, with CI automation and multiple Java report formats.

7.5 Open source Visit site
8

Endor Labs

Free plan APIExtensionLinux+4

Endor Labs brings source, dependency and agent-security capabilities into one platform, with several deployment options.

7.5 Free plan · pricing on request Visit site
9

FOSSA

Free plan APILinuxSelf-hosted+1

FOSSA combines dependency analysis, policy enforcement, and SBOM workflows, with web and self-hosted deployment options.

7.5 Free plan · paid from $20/mo (annual) Visit site
10

bundler-audit

Free plan LinuxMac

bundler-audit focuses on lockfile checks for Ruby and Bundler projects, with offline use, advisory controls and Rake tasks.

7.4 Open source Visit site
11

cargo-audit

Free plan LinuxMac

cargo-audit focuses on Rust crate advisories and provides configurable exceptions plus an experimental dependency-fix command.

7.4 Open source Visit site
12

CVE Binary Tool

Free plan LinuxSelf-hostedWindows

CVE Binary Tool offers broad input, ecosystem, SBOM, VEX, and reporting support at no listed cost. Its self-hosted setup and installation requirements matter when planning deployment.

7.4 Free plan Visit site
13

Nancy

Free plan LinuxMacSelf-hosted+1

Choose Nancy if you need a free command-line vulnerability scan for Go module dependencies and want to use it in documented CI workflows.

7.3 Free plan Visit site
14

OpenSCA

Free plan ExtensionLinuxMac+3

OpenSCA combines dependency risk analysis with SBOM generation, multiple report formats, and several ways to run it.

7.3 Free plan Visit site
15

OSS Review Toolkit

Free plan LinuxMacSelf-hosted+1

ORT offers dependency analysis and policy automation with multiple use and deployment options. Teams configuring the PIP analyzer should account for the documented setup.py execution risk.

7.3 Open source Visit site
16

lockhawk

Free plan APILinuxSelf-hosted

lockhawk offers free, self-hosted dependency vulnerability scanning with offline support, CI integrations, and several report formats.

7.2 Free plan Visit site
17

OSV-Scanner

Free plan LinuxMacSelf-hosted+1

Choose OSV-Scanner if you want a free scanner with broad ecosystem coverage, container scanning, and GitHub Actions workflows.

7.2 Free plan Visit site
18

OWASP dep-scan

Free plan APILinuxMac+2

OWASP dep-scan covers dependency, container, operating-system, and license audits with local or self-hosted operation.

7.2 Free plan Visit site
19

Retire.js

Free plan APIExtensionLinux+4

Retire.js offers command-line, browser, and integration-based scanning, along with CycloneDX SBOM generation.

7.2 Free plan Visit site
20

deppbot

Free plan Web

deppbot provides a daily update schedule and separates public repository access from private repository capacity. Check the private-repository limits and supported ecosystems before choosing a plan.

7.1 Free plan · 14-day trial Visit site
21

depproof

Free plan Self-hosted

depproof combines dependency vulnerability and license checks with self-hosted data handling.

7.1 Free plan · pricing on request Visit site
22

OWASP Dependency-Track

Free plan APISelf-hostedWeb

Choose Dependency-Track if you want a free, self-hosted platform to inventory SBOM components, identify vulnerabilities, and apply policies across projects.

7.1 Free plan Visit site
23

Safety CLI

Free plan LinuxMacSelf-hosted+1

Safety CLI combines dependency scanning, risk prioritization, remediation guidance, and SBOM generation.

7.1 Free plan · paid from $25/user/mo · 7-day trial Visit site
24

ScanCode.io

Free plan APILinuxMac+3

ScanCode.io brings software composition scans, SBOM support, and pipeline integrations into a free, self-hosted tool.

7.1 Open source Visit site
25

govulncheck

Free plan Linux

govulncheck provides focused vulnerability analysis for Go source and binaries, with several machine-readable outputs and editor connections.

7.0 Open source Visit site

#1Places #1, #2, #3, #4, #5 on this list can be bought by the makers of the software on it. See the price

More in Developer Tools