TRUSCA

7.0easy start · #12 of 22
in SBOM Management Software

Free to practise onyes
Free trialnot on record
Well documentedyes
Runs where you worknot on record

Runs on api, Linux, self-hosted, Web.

TRUSCA is ranked #12 of 22 in SBOM management software on The Geeks Club. It runs on API, Linux, Self-hosted, Web. There is a free plan.

TRUSCA plans and pricing

All plans

Apache-2.0 self-hosted Free No per-seat licensing · self-hosted deployment trustedoss.github.io · 3 Oct 2026

Compared on SBOM management software

SBOM standard support: both
Deployment model: self_hosted
Vulnerability analysis: Yes
License analysis: Yes
Policy enforcement: Yes
SBOM exchange: Yes

Best TRUSCA alternatives

See all 20

Sonatype Nexus Repository 0 of 4 in the starter kit Lesson 18.0 sbomify 0 of 4 in the starter kit Lesson 27.9 Exodos Labs 0 of 4 in the starter kit Lesson 37.6 FOSSA 0 of 4 in the starter kit Lesson 47.6 OTNOS SBOM 360 0 of 4 in the starter kit Lesson 57.6 ReARM 0 of 4 in the starter kit Lesson 67.6

The record

Purpose: TRUSCA is a self-hosted software composition analysis platform for CVE tracking, license compliance, and SBOM management.
Component detection: It uses cdxgen to detect packages across 30+ language ecosystems.
Vulnerability feeds: Trivy matches components against NVD, OSV, GitHub Advisory, EPSS, and KEV data, with new CVEs picked up on weekly database refreshes.
SBOM: TRUSCA exports CycloneDX in JSON or XML and SPDX in JSON or Tag-Value, and can ingest CycloneDX or SPDX SBOMs.
CI integrations: The project documents a GitHub Action, GitLab CI template, Jenkinsfile example, REST API, and API keys; its build gate can fail on a Critical CVE or forbidden license.
License workflow: Licenses are classified as allowed, conditional, or forbidden, with NOTICE file generation and build blocking for forbidden licenses.
Notifications and audit: Workflow features include component approval, an append-only audit log, and notifications via email, Slack, and Teams.
Security triage: TRUSCA provides a seven-state CycloneDX VEX triage workflow and EPSS prioritization.
Not a SAST scanner: The documentation says TRUSCA does not analyze users’ own source code and focuses on third-party components.
Deployment: TRUSCA is distributed for users to run themselves with Docker Compose or a Helm chart; a read-only live demo is also available.
Language support: The UI, error messages, and documentation are available in English and Korean.
Support: The project says it has no paid support tier or managed hosting and directs users to its community support channels.
Intended users: The project describes the portal as serving engineering, legal, and security teams.
Price from: Free

Where it ranks on The Geeks Club

Best SBOM Management Software in 2026#12 of 22

Is TRUSCA yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote TRUSCA

Sources

trustedoss.github.io/trusca/docs/intro· checked 3 Oct 2026
trustedoss.github.io/trusca/· checked 3 Oct 2026
github.com/trustedoss/trusca/blob/main/SUPPORT.md· checked 3 Oct 2026