GUAC

GUAC is a free, open-source supply-chain graph for teams that need to connect software metadata across many projects. It is best suited to developers, operations and security practitioners, and Open Source Program Offices managing broad dependency portfolios. The main trade-off is operational: deployment depends on Docker tooling, and most collectors remain experimental.

Overview

GUAC ingests SBOMs and related software metadata, maps relationships between components and upstreams, and exposes the resulting graph through APIs and a visualization tool. This portfolio-wide approach is valuable when an organization must investigate issues across projects instead of opening one SBOM at a time. It can surface vulnerable, deprecated, unsupported or duplicated dependencies and help teams examine risky upstreams with OpenSSF Scorecard.

SPDX and CycloneDX are supported SBOM formats. Stable enrichment sources add vulnerability data from OSV, licensing information from ClearlyDefined and dependency information from Deps.dev. Those connections make the graph useful for security and governance work, although the maturity of data collection varies by collector.

Key features

Cross-project dependency analysis

GUAC's connected model lets teams trace where a dependency appears, relate software artifacts to one another and look for repeated exposure. That is a stronger fit for organizations with numerous repositories or products than for a small team that only needs to inspect an individual SBOM.

APIs and visual exploration

APIs support programmatic queries and integrations, while the visualization tool helps practitioners explore relationships interactively. Together they serve both automated workflows and investigations that benefit from seeing upstream and downstream connections.

Collectors and storage

Collectors can read or watch files, storage buckets and Git repositories. The filesystem collector is stable; the other collectors are experimental, so teams depending on bucket or repository ingestion should budget for evaluation and maintenance. The GraphQL server offers an in-memory backend for transient use and PostgreSQL for persistent storage, allowing a deployment to match its durability requirements.

Deployment and distribution

The setup guide starts the server with Docker Compose and requires Docker, Docker Compose and jq. That prerequisite stack favors teams already comfortable with containerized self-hosting and adds friction for users seeking a hosted service. CLI binaries are provided for Linux x86_64, macOS ARM64 and Windows x86_64.

GUAC is an OpenSSF Incubating Project in the Supply Chain Integrity Working Group. Code uses the MIT license, while documentation is under CC BY 4.0.

Pricing

There are no paid tiers, seat charges or stated usage quotas. The free plan suits teams able to run and maintain their own infrastructure; it does not provide a managed deployment, and the setup prerequisites remain part of the cost of adoption.

Platforms

GUAC supports API, Linux, macOS, self-hosted, web and Windows environments. The available CLI binaries cover Linux x86_64, macOS ARM64 and Windows x86_64, while the server is deployed through Docker Compose.

Who it's for

Developers can use the graph to follow dependencies across products, operations teams can consolidate software inventory, and security practitioners can investigate vulnerabilities and upstream risk. Open Source Program Offices gain a shared portfolio view for licensing and dependency governance. GUAC is less suitable for buyers who require a hosted, turnkey service or mature ingestion across every collector immediately.

Pros and cons

Pros

• Portfolio-level visibility: relationships across projects can reveal recurring dependency and upstream risks that isolated SBOM review misses.
• Useful enrichment: stable OSV, ClearlyDefined and Deps.dev sources add vulnerability, license and dependency context.
• Open and extensible: MIT-licensed code, APIs, PostgreSQL support and multiple SBOM formats suit self-hosted engineering environments.
• No license fee: the project is free to use, with no published seat or quota charges.

Cons

• Operational setup: Docker, Docker Compose and jq are required, so adoption demands container and server administration.
• Collector maturity: only the filesystem collector is stable; other ingestion paths are experimental.
• No hosted tier: teams wanting vendor-managed operations must look elsewhere.

Alternatives

Software Supply Chain Security Software is the broader category to scan when you want to compare approaches.

Sonatype Nexus Repository is a better choice for a paid repository platform with CI/CD integration and an external PostgreSQL option, while its Community Edition is free.

ActiveState Platform fits teams seeking a freemium platform whose free organization plan is limited to public projects.

DevGuard is another freemium supply-chain security option for teams evaluating a different product approach.

Wisec suits smaller usage on a defined free plan with three projects, 1,000 builds per month and 30 days of history.

StepSecurity is preferable when the priority is securing GitHub-hosted runners and unlimited public repositories on its Community plan.

Chainloop is a self-hosted open-source alternative, but its Community Edition has no UI or curated policy library.

SafeDep Platform is worth considering if you want a collection of free open-source tools such as Vet, PMG, xBom and Gryph.

Sigstore is the simpler choice when free signing and provenance services for developers and software providers are the main need.

Verdict

Choose GUAC if your organization needs a queryable, cross-project view of SBOMs, dependencies and upstream risk and can operate a Docker-based self-hosted system. Its free MIT-licensed foundation and portfolio analysis are compelling for engineering and security teams. Look elsewhere if you need managed hosting or dependable non-filesystem collectors without experimental components.