EverythingXiaomi
For vendors
AdvertiseTop spots, featured rows, home sponsor Get listedAdd a product we don't cover yet Claim a listingFree: verify the domain, then correct your page Vendor dashboardNumbers, orders and placements
List your app
Vendor dashboard

OSS Review Toolkit

B
B tier on Software Composition Analysis SoftwareScore 7.0 · #14 of 65
Android app
Not listed
Free plan
Yes
Runs on
Linux, Mac, self-hosted, Windows
oss-review-toolkit.org
The OSS Review Toolkit homepage
Visit site Alternatives

Summary

OSS Review Toolkit (ORT) is a free, open-source toolkit for managing software dependencies and automating FOSS policy checks. It analyzes dependencies, downloads source code, scans for license and copyright findings, retrieves security advisories, evaluates policies, and can report results or send notifications. Its risk-based policy-as-code checks cover licensing, vulnerabilities, InnerSource, and engineering standards. ORT can generate CycloneDX and SPDX SBOMs and custom FOSS attribution documentation. It supports a wide range of package ecosystems, including Gradle, Maven, NPM, Cargo, Composer, PIP, Poetry, and NuGet; vulnerability information can come from configured providers such as OSV, VulnerableCode, OSS Index, and Black Duck. Teams can use it as a library, from the command line, or through CI integrations. It runs on Linux, macOS, and Windows and can be self-hosted. Installation options include Docker images, a binary distribution, or a build from source. The PIP analyzer may execute setup.py files when configured to resolve dependencies, which the documentation identifies as a security risk.

Who it is for

ORT suits teams that need to check dependency licensing, security, and engineering policies or produce SBOMs and attribution documents. It is also suited to teams that want to integrate those workflows into CI or self-host the toolkit.

What is good

  • Free and open source.
  • Generates CycloneDX and SPDX SBOMs.
  • Offers command-line, library, and CI use.
  • Supports many package ecosystems.
  • Produces HTML, Web App, and NOTICE reports.

What to know first

  • Full Docker image is approximately 7 GB.
  • Minimal Docker image is approximately 3 GB.
  • Configured PIP analysis may execute setup.py files.

Verdict

ORT brings dependency analysis, policy evaluation, and reporting into one toolkit. Its broad ecosystem support and multiple usage options suit teams comfortable managing an open-source, self-hosted tool.

OSS Review Toolkit plans and pricing

All plans
OSS Review Toolkit Free Open-source toolkit; no paid limits stated oss-review-toolkit.org · 4 Oct 2026

Compared on software composition analysis software

Supported ecosystems
Bazel, Conan, Pub, Mix, Rebar3, Gleam, Go Modules, Stack, Gradle, Maven, Tycho, Bower, Bun, NPM, PNPM, Yarn, .NET, NuGet, Carthage, CocoaPods, Swift Package Manager, Composer, PIP, Pipenv, Poetry, Bundler, Cargo, SBT, SPDX, ORT Project, Unmanagedoss-review-toolkit.org
SBOM generation
Yesoss-review-toolkit.org
Deployment options
self_hostedoss-review-toolkit.org

Facts

Purpose
ORT is a FOSS policy automation toolkit for managing software dependencies.oss-review-toolkit.org · 4 Oct 2026
SBOMs and attribution
It can generate CycloneDX and SPDX SBOMs, as well as custom FOSS attribution documentation.oss-review-toolkit.org · 4 Oct 2026
Policy checks
Its risk-based policy-as-code checks cover licensing, security vulnerabilities, InnerSource, and engineering standards.oss-review-toolkit.org · 4 Oct 2026
Pipeline tools
The toolkit includes tools to analyze dependencies, download source code, scan for license and copyright findings, retrieve security advisories, evaluate policies, report results, and send notifications.oss-review-toolkit.org · 4 Oct 2026
Usage and CI
ORT can be used as a library, through its command-line interface, or via CI integrations.oss-review-toolkit.org · 4 Oct 2026
Package ecosystem coverage
The analyzer supports package managers including Gradle, Maven, NPM, PNPM, Yarn, Cargo, Composer, PIP, Poetry, and NuGet.oss-review-toolkit.org · 4 Oct 2026
Vulnerability data integrations
The advisor can retrieve vulnerability information from configured providers including OSV, VulnerableCode, OSS Index, and Black Duck.oss-review-toolkit.org · 4 Oct 2026
Report formats
Reporters can produce outputs including CycloneDX BOMs, SPDX documents, static HTML, Web App reports, and NOTICE files.oss-review-toolkit.org · 4 Oct 2026
Installation
ORT is available as Docker images, a binary distribution from GitHub releases, or a build from source.oss-review-toolkit.org · 4 Oct 2026
Container image sizes
For release 13.0.0, the full Docker image is approximately 7 GB and the minimal image approximately 3 GB.oss-review-toolkit.org · 4 Oct 2026
Supported operating systems
The project says ORT is continuously used by its core development team on Linux, Windows, and macOS, which it considers well supported.oss-review-toolkit.org · 4 Oct 2026
Security configuration caveat
The PIP analyzer can execute setup.py files to resolve dependencies when configured to do so, and the documentation flags this as a potential security risk.oss-review-toolkit.org · 4 Oct 2026
Community support
The project links to a community Slack and provides the team contact [email protected].oss-review-toolkit.org · 4 Oct 2026

Best OSS Review Toolkit alternatives

See all 20
Btier Sonatype Nexus Repository #1 7.4 $162.50/moBtier Endor Labs #2 7.3 FreeBtier Snyk Open Source #3 7.3 $25/moBtier Socket #4 7.3 $25/moBtier Accessibility Test Framework for Android #5 7.2 Android FreeBtier Docker Desktop #6 7.2 $9/mo

Where it ranks on Everything Xiaomi

Is OSS Review Toolkit yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote OSS Review Toolkit

Sources