Best Software Composition Analysis Software in 2026
Updated
65 software composition analysis software ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
65ranked
0free plans on this page
5 Oct 2026last checked
0 of the 15 here have a free tier you can use, 0 have open-source code on record, and 0 have full bars: free, open, on most of your devices and documented.
| # | App | Signal | Free tier | Open code | Devices | From | Score |
|---|---|---|---|---|---|---|---|
| 51 | pip-auditNo platforms listed | No signal | — | — | 0 of 6 | — | 5.1 |
| 52 | Retire.jsWeb | No signal | — | — | 1 of 6 | — | 5.1 |
| 53 | Sandworm AuditNo platforms listed | No signal | — | — | 0 of 6 | — | 5.1 |
| 54 | SBOM StudioWeb | No signal | — | — | 1 of 6 | — | 5.1 |
| 55 | ts-scanNo platforms listed | No signal | — | — | 0 of 6 | — | 5.1 |
| 56 | Checkmarx API SecurityWeb · Self-hosted · API | One bar | — | — | 1 of 6 | — | 5.0 |
| 57 | SBOM ObserverWeb · Windows · Mac · Linux | One bar | — | — | 4 of 6 | — | 5.0 |
| 58 | ClairNo platforms listed | No signal | — | — | 0 of 6 | — | 4.9 |
| 59 | Anchore EnterpriseWeb · Linux | No signal | — | — | 2 of 6 | — | 4.8 |
| 60 | Checkmarx SCAWeb | One bar | — | — | 1 of 6 | — | 4.8 |
| 61 | Insignary ClarityWeb | No signal | — | — | 1 of 6 | — | 4.8 |
| 62 | JFrog XrayWeb | One bar | — | — | 1 of 6 | — | 4.8 |
| 63 | MergeBaseWeb | No signal | — | — | 1 of 6 | — | 4.8 |
| 64 | VersionEyeWeb | No signal | — | — | 1 of 6 | — | 4.8 |
| 65 | VulertWeb | One bar | — | — | 1 of 6 | — | 4.8 |
Compare all 15 in a table
| # | App | Score | Free plan | Free plan | Paid from | Supported ecosystems | SBOM generation |
|---|---|---|---|---|---|---|---|
| 51 | pip-audit | 5.1 | No | Yes | — | Python packages; pip; requirements files; pyproject.toml; pylock.*.toml | Yes |
| 52 | Retire.js | 5.1 | No | Yes | — | JavaScript; Node.js modules; npm | Yes |
| 53 | Sandworm Audit | 5.1 | No | Yes | — | npm, Yarn, pnpm, Composer | No |
| 54 | SBOM Studio | 5.1 | No | — | — | — | Yes |
| 55 | ts-scan | 5.1 | No | Yes | — | Maven, Gradle, npm, PyPI, NuGet, Dart, Visual Basic 6, Go, Docker/Syft | Yes |
| 56 | Checkmarx API Security | 5.0 | No | No | — | Java/Maven, JavaScript/TypeScript/NPM, .NET/NuGet, Python/PIP, PHP/Composer, Swift/iOS, Go, Ruby, C/C++/Conan, Unity, Perl/CPAN, Dart/Pub | Yes |
| 57 | SBOM Observer | 5.0 | No | No | — | C/C++/Conan; Dart/Pub; Elixir/Hex; Erlang/Hex; Go; Java/Maven; .NET/NuGet; Node.js/npm; PHP/Composer; Python/PyPI/Pip; Ruby/RubyGems; Rust/Cargo; Swift/CocoaPods | Yes |
| 58 | Clair | 4.9 | No | Yes | — | — | — |
| 59 | Anchore Enterprise | 4.8 | No | No | — | RPM, DEB, APK, ALPM, Portage, Microsoft KB patches, C/C++, Dart, .NET, Elixir, Erlang, Go, Haskell, Java, JavaScript, Jenkins Plugins, Lua, Nix, Objective-C, OCaml, PHP, Python, R, Ruby, Rust, Swift, SWI-Prolog, Bitnami, GitHub Actions, Homebrew, Terraform, WordPress plugins | Yes |
| 60 | Checkmarx SCA | 4.8 | No | No | — | Java/Maven, JavaScript/TypeScript/NPM, .NET/NuGet, Python/PIP, PHP/Composer, Swift/iOS, Go, Ruby, C/C++/Conan, Unity, Perl/CPAN, Dart/Pub | Yes |
| 61 | Insignary Clarity | 4.8 | No | No | — | — | Yes |
| 62 | JFrog Xray | 4.8 | No | No | — | Go, PHP, Java/Maven, Java/Gradle, Java/Ivy, Scala/SBT, JavaScript/npm, Bower, pnpm, Yarn, .NET/NuGet, Python/PyPI, Conda, RubyGems, CocoaPods, Conan, Rust/Cargo, R/CRAN, Swift/SwiftPM, Dart/Flutter/pub, Docker, OCI, Helm, Terraform State | Yes |
| 63 | MergeBase | 4.8 | No | No | — | Java/Maven/Gradle; .NET/NuGet; Go; JavaScript/NPM/Yarn; PHP/Composer; Elixir/Hex; Python/PIP; Dart/Pub; Ruby/Gem; Swift/Swift Package Manager/CocoaPods; Rust/Cargo; C/C++/CMake/Make/Vcpkg/Conan | Yes |
| 64 | VersionEye | 4.8 | No | No | — | Python, Ruby, Node.js, PHP; npm, Composer, Bundler, pip | No |
| 65 | Vulert | 4.8 | No | No | — | Java, JavaScript, PHP, Python, Go, Rust, Ruby, Dart, C/C++, Elixir, CycloneDX, SPDX | Yes |
More in Developer Tools
All developer tools listsAccessibility Testing Software 168Log Management Software 107AI Coding Assistants 103Package Managers 93AI Agent Platforms 73Reverse Engineering Tools 73Browser Automation Tools 63Integrated Development Environments 62Artifact repository software 60Code Playground Software 58Network Monitoring 56Version Control Software 54