GUAC
What it is
GUAC is an open-source tool that connects software metadata to help teams examine supply chain relationships. It ingests information such as software bills of materials (SBOMs) and makes data across a portfolio queryable, rather than limiting analysis to one SBOM at a time. Developers, operations and security practitioners, and Open Source Program Offices can use it to look for vulnerable, deprecated, unsupported or duplicated dependencies, and to identify risky upstream projects using OpenSSF Scorecard. APIs and a visualization tool support querying and exploring the resulting graph. GUAC documents SPDX and CycloneDX SBOM formats, with enrichment sources including OSV for vulnerability data, ClearlyDefined for license information and Deps.dev for dependency information. Its GraphQL server supports in-memory storage or PostgreSQL for persistence. Collectors can read or watch files, storage buckets and Git repositories; the filesystem collector is stable, while other collectors are experimental. Setup uses Docker Compose and requires Docker, Docker Compose and jq. GUAC is an OpenSSF Incubating Project in the Supply Chain Integrity Working Group. Its code is under the MIT license, while documentation content uses CC BY 4.0.
For and against
For
- Queries supply chain data across a software portfolio.
- Supports SPDX and CycloneDX SBOM formats.
- Enriches graphs with vulnerability, license and dependency data.
- Offers in-memory and PostgreSQL storage options.
Against
- Setup requires Docker, Docker Compose and jq.
- Only the filesystem collector is listed as stable.
- Requires deployment and configuration of the server.
The verdict
GUAC helps teams connect SBOM and related metadata into a queryable supply chain view, with APIs and visualization for exploration. Its setup requirements and experimental status of some collectors are important considerations.
Who it suits
GUAC is suited to developers, operations and security practitioners, and Open Source Program Offices seeking a portfolio-wide view of software dependencies. It may fit teams that can set up its Docker-based environment and manage software metadata.
Plans and prices
Open-source GUAC
Apache-2.0 licensed · self-hosted · Docker, Docker Compose and jq required
Read 15 Oct 2026 · rywalker.com
GUAC (open-source project)
Code under MIT license · setup requires Docker, Docker Compose, and jq
Read 7 Oct 2026 · docs.guac.sh
On the record
- API and visualization
- GUAC provides APIs and a visualization tool for querying and exploring software supply chain data.guac.sh · read 7 Oct 2026
- API stability
- The documented GraphQL definitions are explicitly described as unstable and subject to future code changes.docs.guac.sh · read 15 Oct 2026
- Available binaries
- The install guide links GUAC CLI binaries for Linux x86_64, macOS ARM64, and Windows x86_64.docs.guac.sh · read 7 Oct 2026
- Backends
- Supported complete optimized backends are an in-memory keyvalue backend and an Ent backend using PostgreSQL.github.com · read 15 Oct 2026
- Code license
- The public GitHub repository identifies the project code as Apache-2.0 licensed.github.com · read 15 Oct 2026
- Collection
- GUAC collectors can read or watch files, storage buckets, and Git repositories; the filesystem collector is listed as stable while other collectors are experimental.docs.guac.sh · read 7 Oct 2026
- Configuration
- Settings can be supplied by command-line flags, GUAC_ environment variables or guac.yaml, in descending precedence.docs.guac.sh · read 15 Oct 2026
- Deployment
- The setup guide starts the GUAC server using Docker Compose and lists Docker, Docker Compose, and jq as prerequisites.docs.guac.sh · read 7 Oct 2026
- Documentation depth
- Official documentation includes installation, demos, ingestion, PostgreSQL deployment, visualizer setup, configuration, APIs, ontology and observability.docs.guac.sh · read 15 Oct 2026
- Documentation license
- The documentation site states that its content is available under CC BY 4.0.docs.guac.sh · read 15 Oct 2026
- Enrichment integrations
- Stable enrichment sources include OSV for vulnerabilities, ClearlyDefined for licenses and Deps.dev for dependency information.docs.guac.sh · read 15 Oct 2026
- Filesystem collector
- The filesystem collector is marked stable, while other collectors are experimental and may change behavior.docs.guac.sh · read 15 Oct 2026
- GraphQL API
- GUAC exposes a GraphQL API for querying and mutating its software-supply-chain ontology.docs.guac.sh · read 15 Oct 2026
- GraphQL filtering
- An experimental filter directive supports case-insensitive CONTAINS and STARTSWITH comparisons.docs.guac.sh · read 15 Oct 2026
- GUAC 1.0
- OpenSSF announced GUAC 1.0 on June 12, 2025; the project reported more than 400 contributors from over 90 organizations.openssf.org · read 15 Oct 2026
- Independent assessment: early maturity
- SDxCentral described GUAC as beta software intended for experimentation and security-posture investigation at the time of its 2024 coverage.sdxcentral.com · read 15 Oct 2026
- Independent assessment: portfolio scope
- Ry Walker describes GUAC as a cross-cutting graph across SBOMs, attestations, scorecards, VEX and vulnerability data rather than a per-project SBOM manager.rywalker.com · read 15 Oct 2026
- Independent assessment: roadmap gap
- That SDxCentral coverage said prioritized built-in dashboards were still on the roadmap rather than established functionality.sdxcentral.com · read 15 Oct 2026
