SCA

Software Composition Analysis

Identify open-source dependencies and match them against known vulnerability and license data.

28 tools profiled

How it differs Checks the open source packages you depend on for known vulnerabilities and license obligations. Flaws in code you wrote are SAST territory.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals

28 tools

  • OpenText Core SCA (Debricked)

    OpenText

    SCA

    A composition analysis service that resolves dependency trees from source, matches known vulnerabilities, and scores the health and maintenance risk of the projects you depend on.

    Freemium
    Established

  • CAST Highlight

    CAST

    SCA

    A rapid portfolio scanner that analyzes source across hundreds of applications to report open source component risk, license exposure, cloud readiness and software health.

    Commercial
    Established

  • Syft

    Anchore

    SCA

    Command line SBOM generator that catalogs packages in container images, filesystems and archives, emitting SPDX, CycloneDX or its own JSON format.

    Open source
    Established

  • Qwiet AI

    Qwiet AI

    SCA

    Builds a code property graph of the application and its dependencies, then uses data flow across that graph to judge whether a vulnerable library function is actually reachable.

    Commercial
    Growing

  • OpenText Core SCA (Debricked)

    OpenText

    A composition analysis service that resolves dependency trees from source, matches known vulnerabilities, and scores the health and maintenance risk of the projects you depend on.

    Freemium Established
    SCA

  • CAST Highlight

    CAST

    A rapid portfolio scanner that analyzes source across hundreds of applications to report open source component risk, license exposure, cloud readiness and software health.

    Commercial Established
    SCA

  • Syft

    Anchore

    Command line SBOM generator that catalogs packages in container images, filesystems and archives, emitting SPDX, CycloneDX or its own JSON format.

    Open source Established
    SCA

  • Qwiet AI

    Qwiet AI

    Builds a code property graph of the application and its dependencies, then uses data flow across that graph to judge whether a vulnerable library function is actually reachable.

    Commercial Growing
    SCA
Tick up to 4 tools above.