- Home
- Software Composition Analysis Software
- OSS Review Toolkit
On the recordRead 4 Oct 202613 facts
OSS Review Toolkit
Plans and prices
OSS Review Toolkit
Free
Open-source toolkit; no paid limits stated
Read 4 Oct 2026 · oss-review-toolkit.org
On the record
- Community support
- The project links to a community Slack and provides the team contact [email protected].oss-review-toolkit.org · read 4 Oct 2026
- Container image sizes
- For release 13.0.0, the full Docker image is approximately 7 GB and the minimal image approximately 3 GB.oss-review-toolkit.org · read 4 Oct 2026
- Installation
- ORT is available as Docker images, a binary distribution from GitHub releases, or a build from source.oss-review-toolkit.org · read 4 Oct 2026
- Package ecosystem coverage
- The analyzer supports package managers including Gradle, Maven, NPM, PNPM, Yarn, Cargo, Composer, PIP, Poetry, and NuGet.oss-review-toolkit.org · read 4 Oct 2026
- Pipeline tools
- The toolkit includes tools to analyze dependencies, download source code, scan for license and copyright findings, retrieve security advisories, evaluate policies, report results, and send notifications.oss-review-toolkit.org · read 4 Oct 2026
- Policy checks
- Its risk-based policy-as-code checks cover licensing, security vulnerabilities, InnerSource, and engineering standards.oss-review-toolkit.org · read 4 Oct 2026
- Purpose
- ORT is a FOSS policy automation toolkit for managing software dependencies.oss-review-toolkit.org · read 4 Oct 2026
- Report formats
- Reporters can produce outputs including CycloneDX BOMs, SPDX documents, static HTML, Web App reports, and NOTICE files.oss-review-toolkit.org · read 4 Oct 2026
- SBOMs and attribution
- It can generate CycloneDX and SPDX SBOMs, as well as custom FOSS attribution documentation.oss-review-toolkit.org · read 4 Oct 2026
- Security configuration caveat
- The PIP analyzer can execute setup.py files to resolve dependencies when configured to do so, and the documentation flags this as a potential security risk.oss-review-toolkit.org · read 4 Oct 2026
- Supported operating systems
- The project says ORT is continuously used by its core development team on Linux, Windows, and macOS, which it considers well supported.oss-review-toolkit.org · read 4 Oct 2026
- Usage and CI
- ORT can be used as a library, through its command-line interface, or via CI integrations.oss-review-toolkit.org · read 4 Oct 2026
- Vulnerability data integrations
- The advisor can retrieve vulnerability information from configured providers including OSV, VulnerableCode, OSS Index, and Black Duck.oss-review-toolkit.org · read 4 Oct 2026
