Best Software Composition Analysis Software in 2026
Updated
65 software composition analysis software ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
65ranked
4free plans on this page
4 Oct 2026last checked
Software Composition Analysis Software, ranked on how quickly a newcomer can get going. 4 of the 25 on this page can be tried for free.
- 26 Cycode SCA
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: not on record
- 27 DepWarden
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: not on record
- 28 FossID Workbench
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: not on record
- 29 Nancy
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: yes
- 30 OSV-SCALIBR
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: yes
- 31 OWASP AmassFree plan
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: yes
- 32 OWASP dep-scan
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: yes
- 33 Revenera SBOM Insights
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: yes
- 34 Scantist
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: not on record
- 35 cargo-audit
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: not on record
- 36 cargo-deny
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: yes
- 37 CVE Binary Tool
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: not on record
- 38 Eclipse Steady
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: yes
- 39 Finite State Platform
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: not on record
- 40 Lineaje SCA360
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: not on record
- 41 Meterian BOSS
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: not on record
- 42 OSS Review ToolkitFree plan
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: yes
- 43 SafeDep vet
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: not on record
- 44 SBOM Observer
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: yes
- 45 ts-scan
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: not on record
- 46 bundler-auditFree plan
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: not on record
- 47 Checkmarx SCA
- Free to practise on: not on record
- Free trial: not on record
- Well documented: yes
- Runs where you work: not on record
- 48 deppbot
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: not on record
- 49 OWASP Dependency-TrackFree plan
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: not on record
- 50 Retire.js
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: not on record
Compare all 25 in a table
| # | Platform | Score | Free plan | From | Free plan | Paid from | Supported ecosystems | SBOM generation |
|---|---|---|---|---|---|---|---|---|
| 26 | Cycode SCA | 5.9 | No | — | — | — | Java; Python; JavaScript/TypeScript; Go; C#; C++; other languages | Yes |
| 27 | DepWarden | 5.9 | No | — | Yes | — | npm, PyPI, Maven, Gradle, Go, RubyGems, Cargo, NuGet, Composer, Dart (Pub), Swift | Yes |
| 28 | FossID Workbench | 5.9 | No | — | — | — | JavaScript (NPM, Bower, PNPM, Yarn), Java/Kotlin (Maven, Gradle, Ivy, Kotlin), Python (PIP, Pipenv, Poetry, Hatch), Rust/Cargo, Dart/Flutter, PHP/Composer, Ruby/Bundler, Go, C/C++/Conan, CocoaPods/Swift, Yocto, Soong, Elixir, Haskell, .NET, SBT | Yes |
| 29 | Nancy | 5.9 | No | — | Yes | — | Go (go.mod) | — |
| 30 | OSV-SCALIBR | 5.9 | No | — | — | — | Go, Java, JavaScript, Python, Ruby, .NET, C++, Dart, Erlang, Elixir, Haskell, PHP, R, Rust, Swift, Julia, Lua, Nim, Perl; Alpine/APK, DPKG, RPM, Pacman, Homebrew, MacPorts, Chocolatey, Portage, Nix, Spack, Flatpak, Snap, OPKG, Zypper | Yes |
| 31 | OWASP Amass | 5.9 | Free plan | Free | Yes | — | Java/Maven, .NET/NuGet, JavaScript/npm/pnpm/yarn, Ruby/Bundler, Go, Python/pip, PHP/Composer, Dart, Swift Package Manager, Perl/CPAN, Elixir | — |
| 32 | OWASP dep-scan | 5.9 | No | — | Yes | — | Node.js, Java/JVM, PHP, Python, Go, Ruby, Rust, .NET, Dart, Haskell, Elixir, C/C++, Clojure, Docker/OCI, GitHub Actions, Jenkins, YAML manifests | Yes |
| 33 | Revenera SBOM Insights | 5.9 | No | — | — | — | Yocto, Debian, Conan, C/C++, Conda, Docker, Go, Gradle, Maven, Bower, NuGet, npm, Yarn, Composer, PyPI, RPM, RubyGems, Cargo, CocoaPods, Git repositories, Hugging Face | Yes |
| 34 | Scantist | 5.9 | No | — | Yes | — | Java, JavaScript, Perl, Go, Python, C#, C/C++, Ruby, PHP, Objective-C, Swift | Yes |
| 35 | cargo-audit | 5.8 | No | — | — | — | Rust / Cargo | No |
| 36 | cargo-deny | 5.8 | No | — | — | — | Rust; Cargo; crates.io; Git registries; Git repositories | — |
| 37 | CVE Binary Tool | 5.8 | No | — | Yes | — | Dart (pubspec.lock); Go (go.mod); Java (pom.xml, JAR/WAR/EAR); JavaScript (package-lock.json, yarn.lock); OpenWrt opkg (.control); Perl (cpanfile); Python (requirements.txt, PKG-INFO, METADATA, .whl, .egg); Rust (Cargo.lock); Ruby (Gemfile.lock); R (renv.lock); Swift (Package.resolved); Windows PE (.pyd) | Yes |
| 38 | Eclipse Steady | 5.8 | No | — | — | — | Java, Python, Maven, Gradle | — |
| 39 | Finite State Platform | 5.8 | No | — | — | — | C/C++, Rust, Java, Python, JavaScript, Go, Assembly, Swift, Kotlin, C#, PHP, Ruby, Perl, Shell, Scala, Dart, TypeScript, Objective-C; Linux, VxWorks, Windows, macOS, Android, iOS, FreeRTOS, QNX, ThreadX, Zephyr, INTEGRITY, Embedded Linux, Windows IoT, RTEMS; ELF, PE, Mach-O, APK, JAR, WASM, IPA, MSI, DMG, DEB | Yes |
| 40 | Lineaje SCA360 | 5.8 | No | — | — | — | Major programming languages; Maven, Gradle, and npm build systems | Yes |
| 41 | Meterian BOSS | 5.8 | No | — | Yes | — | Binaries, C/C++, Clojure, Dart/Flutter, Elixir, Generic, Golang, Java/Kotlin/Scala, JavaScript, .NET, NodeJS, Perl, PHP, Python, R, Ruby, Rust, Swift/Objective-C | Yes |
| 42 | OSS Review Toolkit | 5.8 | Free plan | Free | — | — | Bazel, Conan, Pub, Mix, Rebar3, Gleam, Go Modules, Stack, Gradle, Maven, Tycho, Bower, Bun, NPM, PNPM, Yarn, .NET, NuGet, Carthage, CocoaPods, Swift Package Manager, Composer, PIP, Pipenv, Poetry, Bundler, Cargo, SBT, SPDX, ORT Project, Unmanaged | Yes |
| 43 | SafeDep vet | 5.8 | No | — | Yes | — | npm, PyPI, Maven, Go, Ruby, Rust, PHP; Docker and OCI container images; CycloneDX and SPDX SBOMs | Yes |
| 44 | SBOM Observer | 5.8 | No | — | No | — | C/C++/Conan; Dart/Pub; Elixir/Hex; Erlang/Hex; Go; Java/Maven; .NET/NuGet; Node.js/npm; PHP/Composer; Python/PyPI/Pip; Ruby/RubyGems; Rust/Cargo; Swift/CocoaPods | Yes |
| 45 | ts-scan | 5.8 | No | — | Yes | — | Maven, Gradle, npm, PyPI, NuGet, Dart, Visual Basic 6, Go, Docker/Syft | Yes |
| 46 | bundler-audit | 5.7 | Free plan | Free | — | — | Ruby gems and Bundler | — |
| 47 | Checkmarx SCA | 5.7 | No | — | No | — | Java/Maven, JavaScript/TypeScript/NPM, .NET/NuGet, Python/PIP, PHP/Composer, Swift/iOS, Go, Ruby, C/C++/Conan, Unity, Perl/CPAN, Dart/Pub | Yes |
| 48 | deppbot | 5.7 | No | — | Yes | — | RubyGems, Bundler, Gemfile, Gemfile.lock | — |
| 49 | OWASP Dependency-Track | 5.7 | Free plan | Free | Yes | — | Cargo, Composer, Gems, Hex, Maven, NPM, NuGet, PyPI | Yes |
| 50 | Retire.js | 5.7 | No | — | Yes | — | JavaScript; Node.js modules; npm | Yes |
More in Developer Tools
All developer tools listsAccessibility Testing Software 168Log Management Software 107AI Coding Assistants 103Package Managers 93AI Agent Platforms 73Reverse Engineering Tools 73Browser Automation Tools 63Integrated Development Environments 62Artifact repository software 60Code Playground Software 58Network Monitoring 56Version Control Software 54