Side by side
cargo-audit vs OSS Review Toolkit
Both stand on software composition analysis software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan LinuxMac
cargo-audit focuses on Rust crate advisories and provides configurable exceptions plus an experimental dependency-fix command. Its binary scan is less complete without cargo-auditable data, and its trusted-project warning matters when a lockfile must be generated.
Visit cargo-audit Free plan LinuxMacSelf-hosted+1
ORT offers dependency analysis and policy automation with multiple use and deployment options. Teams configuring the PIP analyzer should account for the documented setup.py execution risk.
Visit OSS Review ToolkitThe facts
| cargo-audit | OSS Review Toolkit | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Not published | Not published |
| Runs on | Linux, Mac | Linux, Mac, Self-hosted, Windows |
| Lowest paid plan | Free or on request | Free or on request |
| Plans published | 1 | 1 |
| Maker | Not published | Not published |
| Website | rustsec.org | oss-review-toolkit.org |
| On software composition analysis software | #11 of 65 | #15 of 65 |
cargo-audit: what it does well
- Free and open source
- Checks Cargo.lock against RustSec advisories
- Advisory exceptions via `--ignore` or audit.toml
- Experimental fixes support a dry run
What to know first
- Requires Rust 1.74 or later
- Binary recovery misses embedded C and roughly half of Rust dependencies
- Run only on trusted projects
OSS Review Toolkit: what it does well
- Generates CycloneDX and SPDX SBOMs
- Checks licensing, vulnerabilities, and engineering standards
- Works as a library, CLI, or CI integration
- Supports Linux, macOS, Windows, and self-hosting
- Open-source toolkit listed as free
What to know first
- Release 13.0.0 Docker images are approximately 3–7 GB
- PIP setup.py execution can pose a security risk
Alternatives to cargo-audit Alternatives to OSS Review Toolkit The whole list