OSS Review Toolkit

5.8easy start · #42 of 65
in Software Composition Analysis Software

Free to practise onnot on record
Free trialnot on record
Well documentednot on record
Runs where you workyes

Runs on Linux, Mac, self-hosted, Windows.

OSS Review Toolkit is ranked #42 of 65 in software composition analysis software on The Geeks Club. It runs on Linux, macOS, Self-hosted, Windows. There is a free plan.

OSS Review Toolkit plans and pricing

All plans

OSS Review Toolkit Free Open-source toolkit; no paid limits stated oss-review-toolkit.org · 4 Oct 2026

Compared on software composition analysis software

Supported ecosystems: Bazel, Conan, Pub, Mix, Rebar3, Gleam, Go Modules, Stack, Gradle, Maven, Tycho, Bower, Bun, NPM, PNPM, Yarn, .NET, NuGet, Carthage, CocoaPods, Swift Package Manager, Composer, PIP, Pipenv, Poetry, Bundler, Cargo, SBT, SPDX, ORT Project, Unmanaged
SBOM generation: Yes
Deployment options: self_hosted

Best OSS Review Toolkit alternatives

See all 20

Sonatype Nexus Repository 0 of 4 in the starter kit Lesson 18.0 Xygeni 0 of 4 in the starter kit Lesson 27.9 FOSSA 0 of 4 in the starter kit Lesson 37.7 Snyk Open Source 0 of 4 in the starter kit Lesson 47.4 Docker Desktop 0 of 4 in the starter kit Lesson 57.3 Socket 0 of 4 in the starter kit Lesson 67.3

The record

Purpose: ORT is a FOSS policy automation toolkit for managing software dependencies.
SBOMs and attribution: It can generate CycloneDX and SPDX SBOMs, as well as custom FOSS attribution documentation.
Policy checks: Its risk-based policy-as-code checks cover licensing, security vulnerabilities, InnerSource, and engineering standards.
Pipeline tools: The toolkit includes tools to analyze dependencies, download source code, scan for license and copyright findings, retrieve security advisories, evaluate policies, report results, and send notifications.
Usage and CI: ORT can be used as a library, through its command-line interface, or via CI integrations.
Package ecosystem coverage: The analyzer supports package managers including Gradle, Maven, NPM, PNPM, Yarn, Cargo, Composer, PIP, Poetry, and NuGet.
Vulnerability data integrations: The advisor can retrieve vulnerability information from configured providers including OSV, VulnerableCode, OSS Index, and Black Duck.
Report formats: Reporters can produce outputs including CycloneDX BOMs, SPDX documents, static HTML, Web App reports, and NOTICE files.
Installation: ORT is available as Docker images, a binary distribution from GitHub releases, or a build from source.
Container image sizes: For release 13.0.0, the full Docker image is approximately 7 GB and the minimal image approximately 3 GB.
Supported operating systems: The project says ORT is continuously used by its core development team on Linux, Windows, and macOS, which it considers well supported.
Security configuration caveat: The PIP analyzer can execute setup.py files to resolve dependencies when configured to do so, and the documentation flags this as a potential security risk.
Community support: The project links to a community Slack and provides the team contact [email protected].
Price from: Free

Where it ranks on The Geeks Club

Best Software Composition Analysis Software in 2026#42 of 65
Best Open Source License Compliance Software in 2026#28 of 28
Best Dependency Management Software in 2026#25 of 25

Is OSS Review Toolkit yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote OSS Review Toolkit

Sources

oss-review-toolkit.org/ort/docs/intro· checked 4 Oct 2026
oss-review-toolkit.org/ort/docs/tools/analyzer· checked 4 Oct 2026
oss-review-toolkit.org/ort/docs/tools/advisor· checked 4 Oct 2026
oss-review-toolkit.org/ort/docs/tools/reporter· checked 4 Oct 2026
oss-review-toolkit.org/ort/docs/getting-started/installation· checked 4 Oct 2026
oss-review-toolkit.org/ort/docs/getting-started· checked 4 Oct 2026
oss-review-toolkit.org/ort/docs/plugins/package-managers/PIP· checked 4 Oct 2026