SCA

Software Composition Analysis

Identify open-source dependencies and match them against known vulnerability and license data.

28 tools profiled

How it differs Checks the open source packages you depend on for known vulnerabilities and license obligations. Flaws in code you wrote are SAST territory.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals
Clear

14 tools match

Active Rust Clear all

  • Endor Labs

    Endor Labs

    SCA

    A composition analysis platform that builds call graphs across application and dependency code to determine whether a vulnerable function is actually reachable before raising it.

    Commercial
    Growing

  • GitHub Dependabot

    GitHub

    SCA

    GitHub's built-in dependency scanner and update bot, matching your dependency graph against the GitHub Advisory Database and opening pull requests that bump vulnerable packages.

    Free
    Established

  • Sonatype Lifecycle

    Sonatype

    SCA

    Commercial software composition analysis that identifies components by binary fingerprint and enforces staged security and license policy across the build and release pipeline.

    Commercial
    Established

  • Renovate

    Mend

    SCA

    Dependency update bot that detects outdated packages across dozens of package managers and raises pull requests to bump them, with grouping, scheduling and automerge rules.

    Open source
    Established

  • Anchore

    Anchore

    SCA

    An SBOM-first software composition platform that catalogs container and filesystem contents, matches them against vulnerability feeds, and enforces policy in the pipeline.

    Open source and commercial
    Established

  • JFrog Xray

    JFrog

    SCA

    A composition analysis engine layered on JFrog Artifactory that recursively indexes stored artifacts and enforces security and license policy at download and promotion points.

    Commercial
    Established

  • FOSSA

    FOSSA

    SCA

    A composition analysis platform focused on license obligation management, resolving dependencies through native build tooling and generating attribution notices and SBOMs.

    Freemium
    Established

  • Endor Labs

    Endor Labs

    A composition analysis platform that builds call graphs across application and dependency code to determine whether a vulnerable function is actually reachable before raising it.

    Commercial Growing
    SCA

  • GitHub Dependabot

    GitHub

    GitHub's built-in dependency scanner and update bot, matching your dependency graph against the GitHub Advisory Database and opening pull requests that bump vulnerable packages.

    Free Established
    SCA

  • Sonatype Lifecycle

    Sonatype

    Commercial software composition analysis that identifies components by binary fingerprint and enforces staged security and license policy across the build and release pipeline.

    Commercial Established
    SCA

  • Renovate

    Mend

    Dependency update bot that detects outdated packages across dozens of package managers and raises pull requests to bump them, with grouping, scheduling and automerge rules.

    Open source Established
    SCA

  • Anchore

    Anchore

    An SBOM-first software composition platform that catalogs container and filesystem contents, matches them against vulnerability feeds, and enforces policy in the pipeline.

    Open source and commercial Established
    SCA

  • JFrog Xray

    JFrog

    A composition analysis engine layered on JFrog Artifactory that recursively indexes stored artifacts and enforces security and license policy at download and promotion points.

    Commercial Established
    SCA

  • FOSSA

    FOSSA

    A composition analysis platform focused on license obligation management, resolving dependencies through native build tooling and generating attribution notices and SBOMs.

    Freemium Established
    SCA

  • cdxgen

    CycloneDX

    SCA

    A command line SBOM generator that produces CycloneDX bills of materials from source projects, container images, binaries and operating system packages across many ecosystems.

    Open source
    Established

  • OSV-Scanner

    Google

    SCA

    Command line scanner that matches lockfiles, SBOMs and container contents against the OSV.dev advisory database using precise affected version ranges.

    Open source
    Growing

  • Anchore Grype

    Anchore

    SCA

    An open source scanner that matches the contents of container images, filesystems and SBOMs against operating system and language ecosystem vulnerability feeds.

    Open source
    Established

  • Socket

    Socket

    SCA

    Analyzes what a package actually does, including install scripts, network and filesystem access and obfuscated code, to catch supply chain attacks that advisory based scanners never see.

    Open source and commercial
    Growing

  • Mend

    Mend.io

    SCA

    A composition analysis platform combining broad ecosystem coverage, license policy and automated upgrade pull requests, with reachability analysis to prioritize what matters.

    Commercial
    Established

  • OpenText Core SCA (Debricked)

    OpenText

    SCA

    A composition analysis service that resolves dependency trees from source, matches known vulnerabilities, and scores the health and maintenance risk of the projects you depend on.

    Freemium
    Established

  • Syft

    Anchore

    SCA

    Command line SBOM generator that catalogs packages in container images, filesystems and archives, emitting SPDX, CycloneDX or its own JSON format.

    Open source
    Established

  • cdxgen

    CycloneDX

    A command line SBOM generator that produces CycloneDX bills of materials from source projects, container images, binaries and operating system packages across many ecosystems.

    Open source Established
    SCA

  • OSV-Scanner

    Google

    Command line scanner that matches lockfiles, SBOMs and container contents against the OSV.dev advisory database using precise affected version ranges.

    Open source Growing
    SCA

  • Anchore Grype

    Anchore

    An open source scanner that matches the contents of container images, filesystems and SBOMs against operating system and language ecosystem vulnerability feeds.

    Open source Established
    SCA

  • Socket

    Socket

    Analyzes what a package actually does, including install scripts, network and filesystem access and obfuscated code, to catch supply chain attacks that advisory based scanners never see.

    Open source and commercial Growing
    SCA

  • Mend

    Mend.io

    A composition analysis platform combining broad ecosystem coverage, license policy and automated upgrade pull requests, with reachability analysis to prioritize what matters.

    Commercial Established
    SCA

  • OpenText Core SCA (Debricked)

    OpenText

    A composition analysis service that resolves dependency trees from source, matches known vulnerabilities, and scores the health and maintenance risk of the projects you depend on.

    Freemium Established
    SCA

  • Syft

    Anchore

    Command line SBOM generator that catalogs packages in container images, filesystems and archives, emitting SPDX, CycloneDX or its own JSON format.

    Open source Established
    SCA
Tick up to 4 tools above.