Side by side
Kusari vs Marshal
Both stand on dependency management software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Choose Kusari if your team needs a continuously updated view of software components and pull request reviews that consider several types of supply chain risk. The free plan is limited to one private repository, and teams needing more Inspector review capacity or self-hosted deployment should consider those limits before choosing it.
Visit KusariPick Marshal if you maintain Maven or Gradle projects and want self-hosted behavioral checks during dependency updates. It complements a CVE scanner rather than replacing one; teams using Android AGP or Kotlin Multiplatform should look elsewhere for this coverage.
Visit MarshalThe facts
| Kusari | Marshal | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Not published | Not published |
| Runs on | API, Web | Self-hosted |
| Lowest paid plan | Starter Team: $50 per team a month | Free or on request |
| Plans published | 3 | 3 |
| Maker | Not published | Not published |
| Website | kusari.dev | marshalhq.dev |
| On dependency management software | #10 of 27 | #14 of 27 |
Kusari: what it does well
- Maps components across repositories, images and pipelines in a continuously updated graph.
- Scores risk using severity, reachability, exploitability and other factors.
- Accepts CycloneDX and SPDX SBOMs, VEX and scanner output.
- Inspector checks dependencies, secrets, licenses and pipeline or image configuration.
- Integrations include GitHub, GitLab, Jira, Slack and Microsoft Teams.
What to know first
- Free plan includes only one private repository.
- Inspector reviews are capped at 2,000 dependency changes per pull request.
- Self-hosted deployment is unavailable.
Marshal: what it does well
- Scores dependency updates from 0 to 100.
- Checks seven behavioral attack signals.
- GitHub Action checks pull requests.
- Open-source CLI and Action are Apache 2.0 licensed.
- Can run offline for cached packages.
What to know first
- Does not scan for known CVEs.
- Does not support Android AGP or Kotlin Multiplatform in v1.
- CLI requires Java 21 or later.
- Project is described as being in early development.
Alternatives to Kusari Alternatives to Marshal The whole list