17.6
DeepFilterNet is an open-source tool for noise suppression in 48 kHz WAV audio.
Free planOpen sourceAPILinuxmacOS
Best Software Composition Analysis Software in 2026
DeepFilterNet leads this chart of 65 (7.6/10, free plan). Endor Labs is next (7.4/10, free plan), and Grype is the next highest-placed with a free plan (7.4/10). Software composition analysis tools check a project’s software dependencies for security and licensing concerns; compare supported ecosystems and whether the tool can scan pull requests or generate an SBOM. If you plan to manage scans from a Xiaomi, Redmi or POCO device, check Android support directly: the listed platform details cover Linux, self-hosted, web, API, macOS and Windows, but do not specify Android apps.
27.4
Endor Labs scans code, secrets, dependencies, and containers for application security risks.
Free planWebAPIExtension
37.4
Grype checks software packages against known vulnerability data, including in container images and SBOMs.
Free planOpen sourceLinuxmacOSSelf-hosted
- 4
Scantist
Scantist covers application security, software supply chain risk, and security for AI agents and LLM-powered products.
Free planWebAPISelf-hosted7.3$200 one-time - 5
Snyk Open Source
Snyk Open Source is a software composition analysis tool for finding and addressing security vulnerabilities and license issues in open source dependencies.
Free planWebAPILinuxmacOS7.3From $25 a month - 6
Socket
Socket is a developer-first security platform for finding and blocking vulnerable or malicious software dependencies.
Free planWebAPIExtensionLinux7.2From $25 a month - 7
DepWarden
DepWarden is a software composition analysis tool for scanning dependency manifests against vulnerability, exploitability, supply-chain, package…
Free planWebAPILinuxmacOS7.1From $19 a month - 8
Mend SCA
Mend SCA helps development, security, and legal teams identify, prioritize, and remediate security and license risks in open source components.
WebAPILinuxmacOS7.0From $250 a year - 9
ScanCode.io
ScanCode.io offers a web interface and API for scripted software composition analysis scans.
Free planWebAPILinuxmacOS7.0Free plan - 10
Semgrep Supply Chain
Semgrep Supply Chain helps development teams identify vulnerabilities in open-source dependencies, detect malicious packages, and assess whether…
Free planWebAPILinuxmacOS7.0From $30 a month - 11
Trivy
Trivy checks code, binaries, and container images for security flaws and configuration problems.
Free planLinuxmacOSSelf-hostedWindows7.0Free plan - 12
Retire.js
Retire.js checks web and Node.js apps for JavaScript libraries with known vulnerabilities.
Free planWebAPIExtensionLinux6.8Free plan - 13
Twira Dependency Vulnerabilities
Twira Dependency Vulnerabilities scans software lockfiles for known vulnerabilities and filters results through installed-package and code-import reachability checks.
Free planAPILinuxmacOSSelf-hosted6.8From $29.99 a month - 14
Eclipse Steady
Eclipse Steady uses static and dynamic analysis to assess Java and Python apps with vulnerable dependencies.
Free planWebAPILinuxmacOS6.7Free plan - 15
ComplyVigilance SCA
Reviews dependencies for security and license issues, and generates SBOMs in CycloneDX, SPDX, or VEX.
Free planWebAPISelf-hosted6.6From €120 a year - 16
Meterian BOSS
Finds vulnerable or outdated components and license issues; source code stays on your premises.
Free planWebAPI6.6From £2,300 a year - 17
SafeDep vet
Free planLinuxmacOSSelf-hosted6.6From $100 a month - 18
Safety CLI
Safety CLI detects vulnerable dependencies and helps remediate them, with scans described for Python, Java, and JavaScript.
Free planLinuxmacOSSelf-hostedWindows6.6From $25 a month - 19
Xygeni
Xygeni examines directories, repositories, container images, and build configuration for security risks.
Free planWebAPIExtensionLinux6.6Free plan - 20
deppbot
Free planWeb6.5From $5 a month - 21
ZeroPath
ZeroPath is an application security platform for finding and fixing exploitable vulnerabilities across code, cloud, and runtime.
WebAPILinuxmacOS6.5From $1,000 a month - 22
FOSSA
FOSSA scans software to identify dependencies, vulnerabilities, and license issues across the development lifecycle.
Free planWebAPILinuxSelf-hosted6.4Free plan - 23
OpenSCA
OpenSCA examines components for security flaws and open-source licensing concerns, and creates SBOMs.
Free planWebExtensionLinuxmacOS6.4Free plan - 24
Nancy
Nancy checks Go project dependencies against Sonatype Guide for known security flaws.
Free planLinuxmacOSSelf-hostedWindows6.3Free plan - 25
SBOM Observer
WebAPILinuxmacOS6.3From €69 a month
Choosing well
Which ecosystems does it need to support?
Choose a tool that supports the package ecosystems used by your project. Supported ecosystems are one of the comparison points for this category.
Do you need SBOM generation?
Check whether the tool can generate a software bill of materials (SBOM) if you need a record of the components in a project. SBOM generation is a comparison point for these tools.
Can it scan pull requests and check reachability?
Compare pull request scanning and reachability analysis if you want to review dependency risks as code changes are proposed or understand whether vulnerable components are reachable.
How will you deploy and monitor it?
Compare deployment options and monitored projects with the way your team runs its code. Deployment options and monitored projects are both listed comparison points.
Does it have a free plan, and what does paid access cost?
Check the free plan and paid-from price before choosing. Listed examples with a free plan include Grype, Trivy and Snyk Open Source; Snyk Open Source lists paid access from $25 per month.
Questions people ask
What does software composition analysis software do?
It analyzes software dependencies. Compare supported ecosystems, SBOM generation, reachability analysis and pull request scanning.
Can I use software composition analysis software on Android?
The listed platform details do not specify Android apps. Check directly with a tool maker if you need to use or manage scans from an Android device.
Which platforms are listed for software composition analysis tools?
The platform fields include Linux, self-hosted, web, API, macOS and Windows.
Can software composition analysis tools generate an SBOM?
SBOM generation is one of the comparison points for this category. Check a specific tool’s details to confirm its support.
Are there free software composition analysis tools?
Examples marked with a free plan include Grype, Trivy, Retire.js and OpenSCA.
What should I compare when choosing a software composition analysis tool?
Compare supported ecosystems, SBOM generation, reachability analysis, pull request scanning, monitored projects, deployment options, free plans and paid-from prices.