4
Scantist
Scantist covers application security, software supply chain risk, and security for AI agents and LLM-powered products.
Free planWebAPISelf-hosted
7.3$200 one-time
Visit
5
Snyk Open Source
Snyk Open Source is a software composition analysis tool for finding and addressing security vulnerabilities and license issues in open source dependencies.
Free planWebAPILinuxmacOS
7.3From $25 a month
Visit
6
Socket
Socket is a developer-first security platform for finding and blocking vulnerable or malicious software dependencies.
Free planWebAPIExtensionLinux
7.2From $25 a month
Visit
7
DepWarden
DepWarden is a software composition analysis tool for scanning dependency manifests against vulnerability, exploitability, supply-chain, package…
Free planWebAPILinuxmacOS
7.1From $19 a month
Visit
8
Mend SCA
Mend SCA helps development, security, and legal teams identify, prioritize, and remediate security and license risks in open source components.
WebAPILinuxmacOS
7.0From $250 a year
Visit
9
ScanCode.io
ScanCode.io provides a web interface and API for running and reviewing software composition analysis scans in scripted pipelines.
Free planWebAPILinuxmacOS
7.0Free plan
Visit
10
Semgrep Supply Chain
Semgrep Supply Chain helps development teams identify vulnerabilities in open-source dependencies, detect malicious packages, and assess whether…
Free planWebAPILinuxmacOS
7.0From $30 a month
Visit
11
Trivy
Trivy is a free, Apache-2.0-licensed scanner for code repositories, binary artifacts, container images, and Kubernetes clusters.
Free planLinuxmacOSSelf-hostedWindows
7.0Free plan
Visit
12
Retire.js
Retire.js is a free, open-source scanner for finding JavaScript libraries and Node.js modules with known vulnerabilities.
Free planWebAPIExtensionLinux
6.8Free plan
Visit
13
Twira Dependency Vulnerabilities
Twira Dependency Vulnerabilities scans software lockfiles for known vulnerabilities and filters results through installed-package and code-import reachability checks.
Free planAPILinuxmacOSSelf-hosted
6.8From $29.99 a month
Visit
14
Eclipse Steady
Eclipse Steady analyzes Java and Python applications for dependencies on open-source components with known vulnerabilities.
Free planWebAPILinuxmacOS
6.7Free plan
Visit
15
ComplyVigilance SCA
Free planWebAPISelf-hosted
6.6From €120 a year
Visit
16
Meterian BOSS
Free planWebAPI
6.6From £2,300 a year
Visit
17
SafeDep vet
Free planLinuxmacOSSelf-hosted
6.6From $100 a month
Visit
18
Safety CLI
Safety CLI detects vulnerable dependencies and helps remediate them, with scans described for Python, Java, and JavaScript.
Free planLinuxmacOSSelf-hostedWindows
6.6From $25 a month
Visit
19
Xygeni
Xygeni is an application security platform for risks across the software supply chain.
Free planWebAPIExtensionLinux
6.6Free plan
Visit
20
deppbot
Free planWeb
6.5From $5 a month
Visit
21
ZeroPath
ZeroPath is an application security platform for finding and fixing exploitable vulnerabilities across code, cloud, and runtime.
WebAPILinuxmacOS
6.5From $1,000 a month
Visit
22
FOSSA
FOSSA scans software to identify dependencies, vulnerabilities, and license issues across the development lifecycle.
Free planWebAPILinuxSelf-hosted
6.4Free plan
Visit
23
OpenSCA
OpenSCA analyzes software components and dependencies to identify vulnerabilities and open-source license risks.
Free planWebExtensionLinuxmacOS
6.4Free plan
Visit
24
Nancy
Nancy is a free, open-source command-line tool that checks Go module dependencies for vulnerabilities using Sonatype Guide.
Free planLinuxmacOSSelf-hostedWindows
6.3Free plan
Visit
25
SBOM Observer
WebAPILinuxmacOS
6.3From €69 a month
Visit
26
Anchore Enterprise
WebAPILinuxSelf-hosted
6.2
Visit
27
FossID Workbench
FossID Workbench is a software composition analysis tool for identifying and governing third-party components, licenses, and vulnerabilities in codebases.
WebAPILinuxSelf-hosted
6.2
Visit
28
JFrog Xray
JFrog Xray is a paid software composition analysis tool for finding, prioritizing, and remediating vulnerabilities and license compliance issues in…
WebAPISelf-hosted
6.2From $950 a month
Visit
29
MergeBase
WebAPISelf-hosted
6.2From $38 a month
Visit
30
OSS Review Toolkit
OSS Review Toolkit (ORT) is a free, open-source toolkit for managing software dependencies and automating FOSS policy checks.
Free planLinuxmacOSSelf-hostedWindows
6.2Free plan
Visit

Back to Safeguard SCA