OSS Review Toolkit
OSS Review Toolkit (ORT) is a free, open-source toolkit for managing software dependencies and automating FOSS policy checks.
What OSS Review Toolkit is
OSS Review Toolkit (ORT) is a free, open-source toolkit for managing software dependencies and automating FOSS policy checks. It analyzes dependencies, downloads source code, scans for license and copyright findings, retrieves security advisories, evaluates policies, and can report results or send notifications. Its risk-based policy-as-code checks cover licensing, vulnerabilities, InnerSource, and engineering standards. ORT can generate CycloneDX and SPDX SBOMs and custom FOSS attribution documentation. It supports a wide range of package ecosystems, including Gradle, Maven, NPM, Cargo, Composer, PIP, Poetry, and NuGet; vulnerability information can come from configured providers such as OSV, VulnerableCode, OSS Index, and Black Duck. Teams can use it as a library, from the command line, or through CI integrations. It runs on Linux, macOS, and Windows and can be self-hosted. Installation options include Docker images, a binary distribution, or a build from source. The PIP analyzer may execute setup.py files when configured to resolve dependencies, which the documentation identifies as a security risk.
Good
- Free and open source.
- Generates CycloneDX and SPDX SBOMs.
- Offers command-line, library, and CI use.
- Supports many package ecosystems.
- Produces HTML, Web App, and NOTICE reports.
Watch out
- Full Docker image is approximately 7 GB.
- Minimal Docker image is approximately 3 GB.
- Configured PIP analysis may execute setup.py files.
Who it suits
ORT suits teams that need to check dependency licensing, security, and engineering policies or produce SBOMs and attribution documents. It is also suited to teams that want to integrate those workflows into CI or self-host the toolkit.
Verdict
ORT brings dependency analysis, policy evaluation, and reporting into one toolkit. Its broad ecosystem support and multiple usage options suit teams comfortable managing an open-source, self-hosted tool.
Plans and prices
From OSS Review Toolkit's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| OSS Review Toolkit | Free | Open-source toolkit; no paid limits stated |
The facts
Each one read from OSS Review Toolkit's own pages, with the date it was checked.
What it does
- Community support
- The project links to a community Slack and provides the team contact [email protected].checked 4 Oct 2026
- Container image sizes
- For release 13.0.0, the full Docker image is approximately 7 GB and the minimal image approximately 3 GB.checked 4 Oct 2026
- Installation
- ORT is available as Docker images, a binary distribution from GitHub releases, or a build from source.checked 4 Oct 2026
- Package ecosystem coverage
- The analyzer supports package managers including Gradle, Maven, NPM, PNPM, Yarn, Cargo, Composer, PIP, Poetry, and NuGet.checked 4 Oct 2026
- Pipeline tools
- The toolkit includes tools to analyze dependencies, download source code, scan for license and copyright findings, retrieve security advisories, evaluate policies, report results, and send notifications.checked 4 Oct 2026
- Policy checks
- Its risk-based policy-as-code checks cover licensing, security vulnerabilities, InnerSource, and engineering standards.checked 4 Oct 2026
- Purpose
- ORT is a FOSS policy automation toolkit for managing software dependencies.checked 4 Oct 2026
- Report formats
- Reporters can produce outputs including CycloneDX BOMs, SPDX documents, static HTML, Web App reports, and NOTICE files.checked 4 Oct 2026
- SBOMs and attribution
- It can generate CycloneDX and SPDX SBOMs, as well as custom FOSS attribution documentation.checked 4 Oct 2026
- Security configuration caveat
- The PIP analyzer can execute setup.py files to resolve dependencies when configured to do so, and the documentation flags this as a potential security risk.checked 4 Oct 2026
- Supported operating systems
- The project says ORT is continuously used by its core development team on Linux, Windows, and macOS, which it considers well supported.checked 4 Oct 2026
- Usage and CI
- ORT can be used as a library, through its command-line interface, or via CI integrations.checked 4 Oct 2026
- Vulnerability data integrations
- The advisor can retrieve vulnerability information from configured providers including OSV, VulnerableCode, OSS Index, and Black Duck.checked 4 Oct 2026
Alternatives to OSS Review Toolkit
- 1
DeepFilterNet
Free planOpen sourceAPILinuxmacOSSelf-hosted7.6Free plan - 2
FOSSology
Free planOpen sourceWebAPILinuxmacOS7.5Free plan - 3
ScanCode.io
Free planWebAPILinuxmacOS7.0Free plan - 4
SourceTrust
Free planWeb6.7From $299 a year - 5
FOSSA
Free planWebAPILinuxSelf-hosted6.4Free plan - 6
DejaCode
WebAPILinuxSelf-hosted6.3From $500 a month