Best Software Composition Analysis Software in 2026
Updated
In short: Sonatype Nexus Repository is ranked #1 of 65 as of 4 October 2026, ahead of Xygeni and FOSSA. The best-ranked option with a free plan is Xygeni. The lowest first paid tier on this page is Docker Desktop at $9/mo.
Software composition analysis tools help development teams examine components and dependencies in their software. Compared on supported ecosystems, monitored projects, deployment options, pull request scanning, reachability analysis and SBOM generation, the entries offer several points for evaluating coverage and workflow fit. Check free-plan availability and paid starting prices alongside those capabilities. Sonatype Nexus Repository, Xygeni and FOSSA are among the options shown. Consider which ecosystems your projects use, how many projects you need monitored, and whether scanning in pull requests or generating SBOMs is relevant to your process.
65 software composition analysis software ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
Software Composition Analysis Software, ranked on how quickly a newcomer can get going. 14 of the 25 on this page can be tried for free.
- 1 Sonatype Nexus RepositoryPaid from $162.50/mo
- Free to practise on: yes
- Free trial: yes
- Well documented: yes
- Runs where you work: yes
- 2 XygeniFree plan
- Free to practise on: yes
- Free trial: yes
- Well documented: yes
- Runs where you work: yes
- 3 FOSSAPaid from $168392.50/mo
- Free to practise on: yes
- Free trial: yes
- Well documented: yes
- Runs where you work: not on record
- 4 Snyk Open SourcePaid from $25/mo
- Free to practise on: yes
- Free trial: not on record
- Well documented: yes
- Runs where you work: yes
- 5 Docker DesktopPaid from $9/mo
- Free to practise on: yes
- Free trial: not on record
- Well documented: yes
- Runs where you work: yes
- 6 SocketPaid from $25/mo
- Free to practise on: yes
- Free trial: not on record
- Well documented: yes
- Runs where you work: yes
- 7 Semgrep Supply ChainPaid from $30/mo
- Free to practise on: yes
- Free trial: not on record
- Well documented: yes
- Runs where you work: yes
- 8 Veracode DAST
- Free to practise on: not on record
- Free trial: yes
- Well documented: yes
- Runs where you work: yes
- 9 Endor LabsFree plan
- Free to practise on: yes
- Free trial: not on record
- Well documented: yes
- Runs where you work: yes
- 10 GrypeFree plan
- Free to practise on: yes
- Free trial: not on record
- Well documented: yes
- Runs where you work: yes
- 11 TrivyFree plan
- Free to practise on: yes
- Free trial: not on record
- Well documented: yes
- Runs where you work: yes
- 12 Accessibility Test Framework for AndroidFree plan
- Free to practise on: yes
- Free trial: not on record
- Well documented: yes
- Runs where you work: yes
- 13 OSV-ScannerFree plan
- Free to practise on: yes
- Free trial: not on record
- Well documented: yes
- Runs where you work: yes
- 14 DeepFilterNetFree plan
- Free to practise on: yes
- Free trial: not on record
- Well documented: yes
- Runs where you work: yes
- 15 ReversingLabs Cloud Sandbox
- Free to practise on: not on record
- Free trial: not on record
- Well documented: yes
- Runs where you work: yes
- 16 Mend SCAPaid from $83.33/mo
- Free to practise on: not on record
- Free trial: not on record
- Well documented: yes
- Runs where you work: yes
- 17 ZeroPathPaid from $1,000/mo
- Free to practise on: not on record
- Free trial: not on record
- Well documented: yes
- Runs where you work: yes
- 18 Black Duck SCA
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: yes
- 19 Safety CLI
- Free to practise on: not on record
- Free trial: not on record
- Well documented: yes
- Runs where you work: yes
- 20 ScanCode.io
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: yes
- 21 Bomly CLI
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: yes
- 22 OpenSCA
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: yes
- 23 Safeguard DAST
- Free to practise on: not on record
- Free trial: not on record
- Well documented: yes
- Runs where you work: not on record
- 24 Twira Dependency Vulnerabilities
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: yes
- 25 Checkmarx API Security
- Free to practise on: not on record
- Free trial: not on record
- Well documented: yes
- Runs where you work: not on record
Is your platform on this list?
Numbered spots on this list can be sponsored. They are labelled, and the editorial order and scores never change for payment.
Questions about this list
Which software composition analysis software is ranked first on The Geeks Club?
Sonatype Nexus Repository is ranked #1 of 65 with a score of 8.0. Xygeni is second and FOSSA third.
How many of these have a free plan?
13 of the 25 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, Docker Desktop has the lowest first paid tier we found: $9/mo.
How is this list ranked?
Ranked on how quickly a newcomer can get going: documentation depth, a free tier or trial, and the platforms it runs on. Paid placements never change a rank.