OSV-Scanner
OSV-Scanner is a free tool for finding known vulnerabilities in project dependencies against the OSV database.
What OSV-Scanner is
OSV-Scanner is a free tool for finding known vulnerabilities in project dependencies against the OSV database. It runs from the command line or can be imported as a Go library, with support for a range of ecosystems including C/C++, Dart, Go, Java, JavaScript, Python, Ruby, and Rust. It can scan container images for operating-system packages and language artifacts, check dependency licenses against an allowed SPDX list, and generate SBOMs. After an initial database download, it can scan against a local OSV database offline. GitHub Actions workflows support pull-request, scheduled full, and release scans. The scanner sends package names, versions, ecosystems, and file hashes to the OSV.dev API; its README says source code is not sent to deps.dev. SLSA3-compliant binaries and provenance data are available for release verification. Guided remediation is experimental and covers specified npm and Maven files. Transitive dependency scanning is currently supported only for Maven pom.xml, and test dependencies are not supported in its computed dependency graph. The free plan costs nothing.
Good
- Free plan costs nothing.
- Scans source dependencies and container images.
- Supports offline scans after a database download.
- GitHub Actions supports pull-request and scheduled scans.
- Provides SBOM generation and reachability analysis.
Watch out
- Guided remediation is experimental.
- Transitive scanning currently supports Maven pom.xml only.
- Computed dependency graphs do not support test dependencies.
- Prebuilt workflows for other platforms are not offered.
Who it suits
OSV-Scanner suits developers and teams who want to identify known vulnerabilities in dependencies, scan containers, or check licenses. It is available for Linux, macOS, Windows, and self-hosted use.
Verdict
OSV-Scanner offers broad dependency and container scanning with offline use and GitHub Actions workflows. Check its transitive-scanning and test-dependency limits if those matter to your project.
Plans and prices
From OSV-Scanner's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| OSV-Scanner | Free | Open source scanner · CLI and Go library · SLSA3 compliant binaries |
The facts
Each one read from OSV-Scanner's own pages, with the date it was checked.
What it does
- Build provenance
- The project offers SLSA3-compliant binaries for Linux, macOS, and Windows, and releases include SLSA provenance data for verification.checked 4 Oct 2026
- Container scanning
- It scans container images for operating-system packages and language artifacts, including Alpine, Debian, Ubuntu, Go, Java, Node, and Python.checked 4 Oct 2026
- Data sent
- The scanner sends package names, versions, ecosystems, and file hashes to the OSV.dev API; its README says no source code is transmitted to deps.dev.checked 4 Oct 2026
- Dependency coverage
- It supports source scanning across ecosystems including C/C++, Go, Java, JavaScript, Python, Ruby, and Rust, with supported lockfiles and manifests listed in its documentation.checked 4 Oct 2026
- Experimental remediation
- Guided remediation suggests package version upgrades and is marked experimental; the README warns it can run package-manager scripts or follow external registries in untrusted projects.checked 4 Oct 2026
- GitHub integration
- Its GitHub Actions workflows support pull-request scans, scheduled full scans, and scans on release; the documentation says prebuilt workflows for other platforms are not currently offered.checked 4 Oct 2026
- Known limitations
- Transitive dependency scanning is currently supported for Maven pom.xml, and test dependencies are not supported in its computed dependency graph.checked 4 Oct 2026
- License scanning
- It can check dependency licenses using deps.dev data and compare them with an allowed SPDX license list.checked 4 Oct 2026
- Offline mode
- It can scan against a local OSV database without a network connection after the initial database download.checked 4 Oct 2026
- Purpose
- OSV-Scanner finds known vulnerabilities affecting a project's dependencies using the OSV database.checked 4 Oct 2026
- Remediation coverage
- The documented guided-remediation support covers npm package-lock.json and package.json, and Maven pom.xml.checked 4 Oct 2026
- Support
- The project directs users to GitHub issues to report problems and accepts code contributions through its contribution guidelines.checked 4 Oct 2026
- Ways to use
- It can be run as a command-line tool or imported as a Go library.checked 4 Oct 2026
Alternatives to OSV-Scanner
- 1
DeepFilterNet
Free planOpen sourceAPILinuxmacOSSelf-hosted7.6Free plan - 2
Endor Labs
Free planWebAPIExtensionLinux7.4Free plan - 3
Grype
Free planOpen sourceLinuxmacOSSelf-hostedWindows7.4Free plan - 4
Scantist
Free planWebAPISelf-hosted7.3$200 one-time - 5
Snyk Open Source
Free planWebAPILinuxmacOS7.3From $25 a month - 6
Socket
Free planWebAPIExtensionLinux7.2From $25 a month