EVERYTHING XIAOMI
Get listed

OWASP dep-scan

OWASP dep-scan is a free, MIT-licensed tool that audits software dependencies, container images, and operating systems for known vulnerabilities, advisories,…

Place
#31 of 65
Score
6.2
OWASP dep-scan's website

What OWASP dep-scan is

OWASP dep-scan is a free, MIT-licensed tool that audits software dependencies, container images, and operating systems for known vulnerabilities, advisories, and license limitations. It accepts local repositories, Linux container images, Kubernetes manifests, and operating systems, then prioritizes known CVEs. Reachability analysis covers Java, JavaScript and TypeScript, Python, PHP, Rust, Go, and .NET. The tool generates SBOMs with Vulnerability Disclosure Report information and CSAF 2.0 or 2.1 VEX documents. Its vulnerability data includes OSV, NVD, GitHub, NPM, and Linux sources. Package scans can run locally without a server, or dep-scan can run self-hosted with a /scan endpoint for directories, SBOM files, and GitHub repositories. It documents CycloneDX cdxgen, ORAS CLI, and CI integrations. Supported environments include API, Linux, macOS, Windows, and self-hosted deployments.

Good

  • Free open-source MIT license
  • Prioritized CVE findings
  • Reachability analysis across listed ecosystems
  • SBOM and VEX generation
  • Local scanning without a server

Watch out

  • Unsigned macOS binaries may trigger Gatekeeper
  • Server mode and some extensions require the all package
  • Self-hosted setup may be needed for server use

Who it suits

dep-scan suits developers and security teams auditing dependencies, container images, operating systems, and license constraints. It fits users wanting local scanning, self-hosted server operation, SBOMs, or reachability analysis.

Verdict

OWASP dep-scan combines vulnerability, license, reachability, SBOM, and VEX capabilities across many development ecosystems. Its local and self-hosted modes support different deployment needs, while macOS users should expect an unsigned-binary warning.

Plans and prices

From OWASP dep-scan's own pricing page, checked 7 Oct 2026.

All about pricing
PlanPriceWhat it gives you
OWASP dep-scanFreeFully open source · server mode and some extensions require the all package · Free, open-source tool

The facts

Each one read from OWASP dep-scan's own pages, with the date it was checked.

What it does

Inputs
Supports local repositories, Linux container images, Kubernetes manifests, and operating systems.checked 7 Oct 2026
Integrations
Uses CycloneDX cdxgen to create SBOMs and documents integration with ORAS CLI and CI environments.checked 7 Oct 2026
License and audience
The repository identifies the project as MIT licensed and describes it for dependency and container-image security and license audits.checked 7 Oct 2026
Local scanning
Package vulnerability scanning runs locally, and the project says it does not require a server for that mode.checked 7 Oct 2026
Notable limitation
The documented package risk audit mode currently supports npm and PyPI packages only.checked 7 Oct 2026
Prioritization
Identifies known CVEs with prioritization to help users focus on findings that need attention.checked 7 Oct 2026
Purpose
Audits project dependencies, container images, and operating systems for known vulnerabilities, advisories, and license limitations.checked 7 Oct 2026
Reachability
Provides reachability analysis across Java, JavaScript/TypeScript, Python, PHP, Rust, Go, and .NET.checked 7 Oct 2026
Reports
Can generate SBOMs with Vulnerability Disclosure Report information and CSAF 2.0/2.1 VEX documents.checked 7 Oct 2026
Server and API
Can run as a self-hosted server with a /scan endpoint for scanning directories, SBOM files, and GitHub repositories.checked 7 Oct 2026
Server security
The server refuses non-local binding unless an API key is configured or unauthenticated binding is explicitly enabled.checked 7 Oct 2026
Support
The project says developers can be reached through its Discord channel.checked 7 Oct 2026
Vulnerability data
Lists OSV, NVD, GitHub, NPM, and Linux vulnerability data among its sources.checked 7 Oct 2026

Where it runs

Platforms
The repository lists standalone binaries for Linux, macOS, and Windows, and also documents container use.checked 7 Oct 2026

Alternatives to OWASP dep-scan

All alternatives
  1. 1

    DeepFilterNet

    Free planOpen sourceAPILinuxmacOSSelf-hosted
    7.6Free plan
    Visit
  2. 2Endor Labs logo

    Endor Labs

    Free planWebAPIExtensionLinux
    7.4Free plan
    Visit
  3. 3

    Grype

    Free planOpen sourceLinuxmacOSSelf-hostedWindows
    7.4Free plan
    Visit
  4. 4Scantist logo

    Scantist

    Free planWebAPISelf-hosted
    7.3$200 one-time
    Visit
  5. 5Snyk Open Source logo

    Snyk Open Source

    Free planWebAPILinuxmacOS
    7.3From $25 a month
    Visit
  6. 6Socket logo

    Socket

    Free planWebAPIExtensionLinux
    7.2From $25 a month
    Visit