- Home
- Software Composition Analysis Software
- Eclipse Steady
Eclipse Steady
What it is
Eclipse Steady analyzes Java and Python applications for dependencies on open-source components with known vulnerabilities. Its static and dynamic analysis collects evidence about whether vulnerable code can be reached or executed in the application, giving teams a code usage view of risk. The project includes Java and Python client tools, server-side REST services, and web frontends. Java scanning workflows cover Maven, Gradle, and command-line use; Python scanning is documented through the command line. Teams can automate scans with Jenkins and other continuous integration systems, then assess findings in the web frontend. Java Maven reports can be saved in HTML, XML, or JSON. Eclipse Steady is free and open source under the Apache License 2.0. Its Docker Compose backend must be running during scans, and initial setup processes vulnerability information from the project’s knowledge base, followed by daily updates. The site labels version 3.2.5 an Incubator Project.
For and against
For
- Analyzes Java and Python applications.
- Combines static and dynamic analysis.
- Supports Maven, Gradle, and command-line scans.
- Java Maven reports support HTML, XML, and JSON.
- Free and open source under Apache License 2.0.
Against
- The Docker Compose backend must run during scans.
- The documented Docker setup is not intended for productive use.
- The site labels version 3.2.5 an Incubator Project.
The verdict
Eclipse Steady provides code usage analysis for Java and Python dependency scanning, with CI guidance and several report formats. Teams should account for operating its backend and review the project’s stated deployment caveat.
Who it suits
Eclipse Steady suits developers who scan Java or Python applications and want to assess whether vulnerable dependencies are used in application code. Its documented workflows include Maven, Gradle, command-line scanning, and CI automation.
Plans and prices
Open-source software
Apache License 2.0
Read 11 Oct 2026 · eclipse-steady.github.io
On the record
- Analysis
- It combines static and dynamic analysis to collect evidence about whether vulnerable code is reachable or executed in an application context.eclipse-steady.github.io · read 4 Oct 2026
- Assessment
- Its code-centric, usage-based approach is intended to support more accurate detection and assessment than approaches relying on metadata.eclipse-steady.github.io · read 4 Oct 2026
- Audience
- The documented workflow has developers scan Java or Python applications regularly and assess findings in the apps web frontend.eclipse-steady.github.io · read 11 Oct 2026
- Build integrations
- The documentation provides scanning tutorials for Java applications built with Maven or Gradle and Python applications using the CLI.eclipse-steady.github.io · read 11 Oct 2026
- CI automation
- The user guide describes automating scans with Jenkins or other continuous integration systems.eclipse-steady.github.io · read 11 Oct 2026
- CI integration
- The documentation includes guidance for automating scans with Jenkins and other continuous integration systems.eclipse-steady.github.io · read 4 Oct 2026
- Components
- The project comprises client-side tools for Java and Python, server-side RESTful services, and web frontends.eclipse-steady.github.io · read 11 Oct 2026
- Deployment
- The backend is a Docker Compose application that stores vulnerability information and scan results, and must be running during scans.eclipse-steady.github.io · read 4 Oct 2026
- Deployment caveat
- The Docker deployment tutorial says its demonstrated setup is not intended for productive scenarios because of security and scalability concerns.eclipse-steady.github.io · read 4 Oct 2026
- Detection method
- Its code-centric, usage-based approach combines static and dynamic analysis to assess vulnerable dependencies.eclipse-steady.github.io · read 11 Oct 2026
- Java support
- The documentation provides Java scanning tutorials for Maven, Gradle, and command-line use.eclipse-steady.github.io · read 4 Oct 2026
- License
- The project says it was open-sourced in October 2018 under the Apache License v.2.0.eclipse-steady.github.io · read 4 Oct 2026
- License and origin
- Initially developed by SAP Security Research, Eclipse Steady was open-sourced in October 2018 under Apache License 2.0.eclipse-steady.github.io · read 11 Oct 2026
- Project status
- The maker's site labels Eclipse Steady version 3.2.5 as an Incubator Project.eclipse-steady.github.io · read 4 Oct 2026
- Purpose
- Eclipse Steady analyzes Java and Python applications for dependencies with known vulnerabilities and helps developers mitigate them.eclipse-steady.github.io · read 11 Oct 2026
- Python support
- The documentation provides a command-line scanning workflow for Python applications.eclipse-steady.github.io · read 4 Oct 2026
- Reports
- The Gradle tutorial says summary reports can be written in HTML, XML, and JSON, and a build exception is thrown by default when the application includes a library with known vulnerabilities.eclipse-steady.github.io · read 11 Oct 2026
- Self-hosting
- The project documents deploying its backend services with Docker Compose, while warning that the documented setup is for demonstration and not productive scenarios due to security and scalability concerns.eclipse-steady.github.io · read 11 Oct 2026
