EverythingXiaomi
For vendors
AdvertiseTop spots, featured rows, home sponsor Get listedAdd a product we don't cover yet Claim a listingFree: verify the domain, then correct your page Vendor dashboardNumbers, orders and placements
List your app
Vendor dashboard

Best Software Composition Analysis Software in 2026

Updated

In short: Sonatype Nexus Repository is ranked #1 of 64 as of 4 October 2026, ahead of Endor Labs and Snyk Open Source. The best-ranked option with a free plan is Endor Labs. The lowest first paid tier on this page is Docker Desktop at $9/mo.

If you need to review software dependencies, compare these tools on the ecosystems they support and the projects they monitor. The ranking also covers deployment options, pull request scanning, reachability analysis and SBOM generation, giving you several ways to assess fit with your development process. Free-plan availability and paid-from pricing are listed too. Snyk Open Source, Endor Labs and Socket appear first, followed by FOSSA and Semgrep Supply Chain. Consider which scanning capabilities matter for your workflow and how much project coverage you need, then weigh the listed options against the ecosystems your team uses.

64 software composition analysis software ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.

64ranked
12free plans on this page
$9/molowest paid tier
4 Oct 2026last checked
#1 Sonatype Nexus Repository Top pick · 7.4 Free plan · $162.50/mo #2 Endor Labs Runner-up · 7.3 Free plan · Free #3 Snyk Open Source Also great · 7.3 Free plan · $25/mo
  1. 1

    Sonatype Nexus Repository

    7.4
    Free planFree trial apiLinuxmacOSself-hostedWebWindows
    Free plan
    No
    Supported ecosystems
    C++/Conan; Conda; Dart and Flutter/pub; Go/Go Modules; Hugging Face; Java/Maven, Gradle, Ivy; JavaScript/npm, yarn; .NET/NuGet; Objective-C/CocoaPods; PHP/Composer; Python/PyPI, Poetry, pipenv; R/CRAN; RPM/Yum and Fedora EPEL; Ruby/RubyGems and Bundler; Rust/Cargo; Swift/Swift
    SBOM generation
    Yes
    Reachability analysis
    Yes
    Pull request scanning
    Yes
    RecognisedDocumentedFree planPlatforms
    $162.50/mofirst paid tier About Sonatype Nexus RepositoryVisit site
  2. 2

    Endor Labs

    7.3
    Free plan apiLinuxmacOSWebWindows
    Free plan
    Yes
    Supported ecosystems
    C/C++, Go, Java, JavaScript, Kotlin, .NET (C#), PHP, Python, Ruby, Rust, Scala, Swift, TypeScript, Bazel
    SBOM generation
    Yes
    Reachability analysis
    Yes
    Pull request scanning
    Yes
    RecognisedDocumentedFree planPlatforms
    Free About Endor LabsVisit site
  3. 3

    Snyk Open Source

    7.3
    Free plan apiLinuxmacOSWebWindows
    Free plan
    Yes
    Supported ecosystems
    C/C++, Dart/Flutter, Elixir, Go, Java/Kotlin, JavaScript, .NET, PHP, Python, Ruby, Rust (limited), Scala, Swift/Objective-C, TypeScript; npm, pnpm, Yarn, Maven, Gradle, Pip, Poetry, pipenv and setup.py
    SBOM generation
    Yes
    Reachability analysis
    Yes
    Pull request scanning
    Yes
    RecognisedDocumentedFree planPlatforms
    $25/mofirst paid tier About Snyk Open SourceVisit site
  4. 4

    Socket

    7.3
    Free plan apiextensionLinuxmacOSself-hostedWebWindows
    Free plan
    Yes
    Supported ecosystems
    JavaScript/TypeScript, Python, Go, Java, Ruby, .NET, Scala, Kotlin, Rust, PHP, Swift, C/C++, Julia, Dart, Elixir/Erlang, GitHub Actions
    SBOM generation
    Yes
    Reachability analysis
    Yes
    Pull request scanning
    Yes
    RecognisedDocumentedFree planPlatforms
    $25/mofirst paid tier About SocketVisit site
  5. 5

    Accessibility Test Framework for Android

    7.2
    Free plan AndroidLinuxmacOSWindows
    Supported ecosystems
    Go, Java, JavaScript, Python, Ruby, .NET, C++, Dart, Erlang, Elixir, Haskell, PHP, R, Rust, Swift, Julia, Lua, Nim, Perl; Alpine/APK, DPKG, RPM, Pacman, Homebrew, MacPorts, Chocolatey, Portage, Nix, Spack, Flatpak, Snap, OPKG, Zypper
    SBOM generation
    Yes
    Reachability analysis
    Yes
    RecognisedDocumentedFree planPlatforms
    Free About Accessibility Test Framework for AndroidVisit site
  6. 6

    Docker Desktop

    7.2
    Free plan LinuxmacOSWebWindows
    Free plan
    Yes
    SBOM generation
    Yes
    RecognisedDocumentedFree planPlatforms
    $9/mofirst paid tier About Docker DesktopVisit site
  7. 7

    Trivy

    7.2
    Free plan LinuxmacOSself-hostedWindows
    Free plan
    Yes
    Supported ecosystems
    Ruby, Python, PHP, Node.js, .NET, Java, Go, Rust, C/C++, Elixir, Dart, Swift, Julia, and operating-system packages
    SBOM generation
    Yes
    RecognisedDocumentedFree planPlatforms
    Free About TrivyVisit site
  8. 8

    Xygeni

    7.2
    Free planFree trial apiextensionLinuxmacOSself-hostedWebWindows
    Free plan
    Yes
    Supported ecosystems
    Maven, Gradle, npm, Yarn, Bower, .NET, Go, Python/Pip, PHP/Composer, Ruby, Dart/Flutter
    SBOM generation
    Yes
    Reachability analysis
    Yes
    Pull request scanning
    Yes
    RecognisedDocumentedFree planPlatforms
    Free About XygeniVisit site
  9. 9

    Semgrep Supply Chain

    7.1
    Free plan apiLinuxmacOSself-hostedWeb
    Free plan
    Yes
    Supported ecosystems
    C# (NuGet); Dart (Pub); Go (Go modules); Java (Gradle, Maven); JavaScript/TypeScript (npm, Yarn, pnpm); Kotlin (Gradle, Maven); PHP (Composer); Python (pip, pip-tool, Pipenv, Poetry); Ruby (RubyGems); Rust (Cargo); Scala (Maven); Swift (SwiftPM)
    SBOM generation
    Yes
    Reachability analysis
    Yes
    Pull request scanning
    Yes
    RecognisedDocumentedFree planPlatforms
    $30/mofirst paid tier About Semgrep Supply ChainVisit site
  10. 10

    FOSSA

    7.0
    Free planFree trial apiLinuxself-hostedWeb
    Free plan
    Yes
    Supported ecosystems
    JavaScript/TypeScript, Java/Kotlin, Python, Go, Ruby, Rust, Clojure, Elixir, iOS/Objective-C/Swift, .NET, PHP, Dart, Erlang, Fortran, Haskell, Perl
    SBOM generation
    Yes
    Reachability analysis
    Yes
    Pull request scanning
    Yes
    RecognisedDocumentedFree planPlatforms
    $168392.50/mofirst paid tier About FOSSAVisit site
  11. 11

    Grype

    7.0
    Free plan LinuxmacOSself-hostedWindows
    Free plan
    Yes
    Supported ecosystems
    Alpine, Debian, Ubuntu, RHEL, SUSE, Amazon Linux, PyPI, npm, Maven, Go modules, Composer, NuGet, Pub, RubyGems, Crates, Swift, GitHub Actions, Bitnami, Conda, WordPress plugins
    SBOM generation
    Yes
    RecognisedDocumentedFree planPlatforms
    Free About GrypeVisit site
  12. 12

    OSV-Scanner

    7.0
    Free plan LinuxmacOSself-hostedWindows
    Free plan
    Yes
    Supported ecosystems
    C/C++, Dart, Elixir, Go, Haskell, Java, JavaScript, .NET, PHP, Python, R, Ruby, Rust; npm, pip, Maven, Go Modules, Cargo, Gem, Composer, NuGet
    SBOM generation
    Yes
    Reachability analysis
    Yes
    Pull request scanning
    Yes
    RecognisedDocumentedFree planPlatforms
    Free About OSV-ScannerVisit site
  13. 13

    ReversingLabs Cloud Sandbox

    6.8
    AndroidapiLinuxmacOSWebWindows
    Free plan
    Yes
    Supported ecosystems
    npm, PyPI, RubyGems, NuGet, VS Code, PS Gallery, Docker, Amazon ECR, Hugging Face, Maven, Windows, Linux, macOS, containers, virtual machines
    SBOM generation
    Yes
    Reachability analysis
    Yes
    RecognisedDocumentedFree planPlatforms
    About ReversingLabs Cloud SandboxVisit site
  14. 14

    Veracode DAST

    6.7
    Free trial apiLinuxmacOSWebWindows
    Supported ecosystems
    C#/.NET (DLL, NuGet); C/C++ (Make); Go (Dep, Glide, go get, Go modules, GoDep, GoVendor, Trash); Java (Ant, Gradle, JARs, Maven); JavaScript (Bower, NPM, Yarn); Kotlin (Gradle, JARs, Maven); Objective-C (CocoaPods); PHP (Composer); Python (pip, Pipenv, Poetry); Ruby (Bundler); Scala (JARs, SBT); Swift (CocoaPods); TypeScript (Bower, NPM, Yarn)
    SBOM generation
    Yes
    Reachability analysis
    Yes
    Pull request scanning
    Yes
    RecognisedDocumentedFree planPlatforms
    About Veracode DASTVisit site
  15. 15

    ZeroPath

    6.4
    apiLinuxmacOSself-hostedWebWindows
    Free plan
    No
    Paid from
    60 /user/mo
    RecognisedDocumentedFree planPlatforms
    $1,000/mofirst paid tier About ZeroPathVisit site
  16. 16

    Black Duck SCA

    6.1
    WebWindowsmacOSLinux
    Supported ecosystems
    BitBake, Cargo, Carthage, CocoaPods, Conan, Conda, CPAN, CRAN, Dart, Go, Gradle, Hex, Ivy, Lerna, Maven, npm, NuGet, Packagist, PEAR, pip, pnpm, Poetry, RubyGems, SBT, Setuptools, Swift, Yarn, Xcode, OPAM, UV, Rush
    SBOM generation
    Yes
    Reachability analysis
    Yes
    Pull request scanning
    Yes
    RecognisedDocumentedFree planPlatforms
    About Black Duck SCAVisit site
  17. 17

    Checkmarx API Security

    6.1
    apiself-hostedWeb
    Free plan
    No
    Supported ecosystems
    Java/Maven, JavaScript/TypeScript/NPM, .NET/NuGet, Python/PIP, PHP/Composer, Swift/iOS, Go, Ruby, C/C++/Conan, Unity, Perl/CPAN, Dart/Pub
    SBOM generation
    Yes
    Reachability analysis
    Yes
    Pull request scanning
    Yes
    RecognisedDocumentedFree planPlatforms
    About Checkmarx API SecurityVisit site
  18. 18

    Safety CLI

    6.1
    WindowsmacOSLinux
    Free plan
    Yes
    Paid from
    25 /user/mo
    Supported ecosystems
    Python
    SBOM generation
    Yes
    Reachability analysis
    Yes
    RecognisedDocumentedFree planPlatforms
    About Safety CLIVisit site
  19. 19

    ScanCode.io

    6.1
    WebLinuxmacOSWindows
    Supported ecosystems
    npm, PyPI, Maven, NuGet, RubyGems, Cargo, Composer, Conda, Docker; Java, Scala, Kotlin, Groovy, Clojure, JavaScript, TypeScript, Go, Rust, Python, Debian
    SBOM generation
    Yes
    Pull request scanning
    Yes
    RecognisedDocumentedFree planPlatforms
    About ScanCode.ioVisit site
  20. 20

    Bomly CLI

    6.0
    LinuxmacOSWindows
    Free plan
    Yes
    Supported ecosystems
    C++, Dart, .NET/NuGet, Elixir, GitHub Actions, Go, Maven, Gradle, npm, pnpm, Yarn, Bun, PHP/Composer, Python/pip/Pipenv/Poetry/uv, Ruby/Bundler, Rust/Cargo, Scala/SBT, Swift/CocoaPods/SwiftPM, plus Syft-backed ecosystems
    SBOM generation
    Yes
    Reachability analysis
    Yes
    Pull request scanning
    Yes
    RecognisedDocumentedFree planPlatforms
    About Bomly CLIVisit site
  21. 21

    Mend SCA

    6.0
    apiLinuxmacOSWebWindows
    Free plan
    No
    Supported ecosystems
    C/C++/Conan, C#/.NET/NuGet, Go, Java/Maven/Gradle, JavaScript/npm/yarn/pnpm, PHP/Composer, Python/pip/Poetry/Conda/uv, Ruby/Bundler, Scala/sbt, Swift/SwiftPM/CocoaPods, Rust/Cargo, Haskell/Cabal, Elixir/Erlang/Hex, Bazel, OCaml
    SBOM generation
    Yes
    Reachability analysis
    Yes
    Pull request scanning
    Yes
    RecognisedDocumentedFree planPlatforms
    $83.33/mofirst paid tier About Mend SCAVisit site
  22. 22

    OpenSCA

    6.0
    WindowsLinuxmacOS
    Free plan
    Yes
    Supported ecosystems
    Java/Maven, Java/Gradle, JavaScript/NPM, PHP/Composer, Ruby/gem, Golang/Go mod, Rust/cargo, Erlang/Rebar, Python/Pip
    SBOM generation
    Yes
    Pull request scanning
    Yes
    RecognisedDocumentedFree planPlatforms
    About OpenSCAVisit site
  23. 23

    Twira Dependency Vulnerabilities

    6.0
    WindowsmacOSLinux
    Free plan
    Yes
    Supported ecosystems
    npm, Cargo, PyPI, Go, Maven, RubyGems, Packagist, NuGet, Swift Package Manager
    SBOM generation
    No
    Reachability analysis
    Yes
    RecognisedDocumentedFree planPlatforms
    About Twira Dependency VulnerabilitiesVisit site
  24. 24

    OSV-SCALIBR

    5.9
    LinuxmacOSWindows
    Supported ecosystems
    Go, Java, JavaScript, Python, Ruby, .NET, C++, Dart, Erlang, Elixir, Haskell, PHP, R, Rust, Swift, Julia, Lua, Nim, Perl; Alpine/APK, DPKG, RPM, Pacman, Homebrew, MacPorts, Chocolatey, Portage, Nix, Spack, Flatpak, Snap, OPKG, Zypper
    SBOM generation
    Yes
    Reachability analysis
    Yes
    RecognisedDocumentedFree planPlatforms
    About OSV-SCALIBRVisit site
  25. 25

    OWASP dep-scan

    5.9
    WindowsmacOSLinux
    Free plan
    Yes
    Supported ecosystems
    Node.js, Java/JVM, PHP, Python, Go, Ruby, Rust, .NET, Dart, Haskell, Elixir, C/C++, Clojure, Docker/OCI, GitHub Actions, Jenkins, YAML manifests
    SBOM generation
    Yes
    Reachability analysis
    Yes
    RecognisedDocumentedFree planPlatforms
    About OWASP dep-scanVisit site

Is your app on this list?

Numbered spots on this list can be sponsored. They are labelled, and the editorial order and scores never change for payment.

#1 open#2 open#3 open#4 open#5 openClaim your listing — free

Questions about this list

Which software composition analysis software is ranked first on Everything Xiaomi?

Sonatype Nexus Repository is ranked #1 of 64 with a score of 7.4. Endor Labs is second and Snyk Open Source third.

How many of these have a free plan?

12 of the 25 on this page publish a free plan on their own pricing pages.

Which is the cheapest paid option?

On this page, Docker Desktop has the lowest first paid tier we found: $9/mo.

How is this list ranked?

Ranked on what each maker publishes: documentation depth, a free tier and the platforms it runs on. Paid placements never change a rank.

More in Developer Tools

All developer tools lists
Accessibility Testing Software 168Log Management Software 107AI Coding Assistants 103Package Managers 93AI Agent Platforms 73Reverse Engineering Tools 73Browser Automation Tools 63Integrated Development Environments 62Artifact repository software 60Code Playground Software 58Network Monitoring 55Version Control Software 54