4
Snyk Open Source
Snyk Open Source is a software composition analysis tool for finding and addressing security vulnerabilities and license issues in open source dependencies.
Free planWebAPILinuxmacOS
7.3From $25 a month
Visit
5
Socket
Socket is a developer-first security platform for finding and blocking vulnerable or malicious software dependencies.
Free planWebAPIExtensionLinux
7.2From $25 a month
Visit
6
DepWarden
DepWarden is a software composition analysis tool for scanning dependency manifests against vulnerability, exploitability, supply-chain, package…
Free planWebAPILinuxmacOS
7.1From $19 a month
Visit
7
Mend SCA
Mend SCA helps development, security, and legal teams identify, prioritize, and remediate security and license risks in open source components.
WebAPILinuxmacOS
7.0From $250 a year
Visit
8
ScanCode.io
ScanCode.io provides a web interface and API for running and reviewing software composition analysis scans in scripted pipelines.
Free planWebAPILinuxmacOS
7.0Free plan
Visit
9
Semgrep Supply Chain
Semgrep Supply Chain helps development teams identify vulnerabilities in open-source dependencies, detect malicious packages, and assess whether…
Free planWebAPILinuxmacOS
7.0From $30 a month
Visit
10
Trivy
Trivy is a free, Apache-2.0-licensed scanner for code repositories, binary artifacts, container images, and Kubernetes clusters.
Free planLinuxmacOSSelf-hostedWindows
7.0Free plan
Visit
11
Retire.js
Retire.js is a free, open-source scanner for finding JavaScript libraries and Node.js modules with known vulnerabilities.
Free planWebAPIExtensionLinux
6.8Free plan
Visit
12
Twira Dependency Vulnerabilities
Twira Dependency Vulnerabilities scans software lockfiles for known vulnerabilities and filters results through installed-package and code-import reachability checks.
Free planAPILinuxmacOSSelf-hosted
6.8From $29.99 a month
Visit
13
Eclipse Steady
Eclipse Steady analyzes Java and Python applications for dependencies on open-source components with known vulnerabilities.
Free planWebAPILinuxmacOS
6.7Free plan
Visit
14
ComplyVigilance SCA
Free planWebAPISelf-hosted
6.6From €120 a year
Visit
15
Meterian BOSS
Free planWebAPI
6.6From £2,300 a year
Visit
16
SafeDep vet
Free planLinuxmacOSSelf-hosted
6.6From $100 a month
Visit
17
Safety CLI
Safety CLI detects vulnerable dependencies and helps remediate them, with scans described for Python, Java, and JavaScript.
Free planLinuxmacOSSelf-hostedWindows
6.6From $25 a month
Visit
18
Xygeni
Xygeni is an application security platform for risks across the software supply chain.
Free planWebAPIExtensionLinux
6.6Free plan
Visit
19
deppbot
Free planWeb
6.5From $5 a month
Visit
20
ZeroPath
ZeroPath is an application security platform for finding and fixing exploitable vulnerabilities across code, cloud, and runtime.
WebAPILinuxmacOS
6.5From $1,000 a month
Visit
21
FOSSA
FOSSA scans software to identify dependencies, vulnerabilities, and license issues across the development lifecycle.
Free planWebAPILinuxSelf-hosted
6.4Free plan
Visit
22
OpenSCA
OpenSCA analyzes software components and dependencies to identify vulnerabilities and open-source license risks.
Free planWebExtensionLinuxmacOS
6.4Free plan
Visit
23
Nancy
Nancy is a free, open-source command-line tool that checks Go module dependencies for vulnerabilities using Sonatype Guide.
Free planLinuxmacOSSelf-hostedWindows
6.3Free plan
Visit
24
SBOM Observer
WebAPILinuxmacOS
6.3From €69 a month
Visit
25
Anchore Enterprise
WebAPILinuxSelf-hosted
6.2
Visit
26
FossID Workbench
FossID Workbench is a software composition analysis tool for identifying and governing third-party components, licenses, and vulnerabilities in codebases.
WebAPILinuxSelf-hosted
6.2
Visit
27
JFrog Xray
JFrog Xray is a paid software composition analysis tool for finding, prioritizing, and remediating vulnerabilities and license compliance issues in…
WebAPISelf-hosted
6.2From $950 a month
Visit
28
MergeBase
WebAPISelf-hosted
6.2From $38 a month
Visit
29
OSS Review Toolkit
OSS Review Toolkit (ORT) is a free, open-source toolkit for managing software dependencies and automating FOSS policy checks.
Free planLinuxmacOSSelf-hostedWindows
6.2Free plan
Visit
30
OWASP dep-scan
OWASP dep-scan is a free, MIT-licensed tool that audits software dependencies, container images, and operating systems for known vulnerabilities,…
Free planAPILinuxmacOSSelf-hosted
6.2Free plan
Visit

Back to Grype