Twira Dependency Vulnerabilities

Plans and prices

Every plan, in full

On the record

Company

The maker identifies itself as Twira Ltd, registered in England and Wales, with a registered office in London.twira.com · read 9 Oct 2026

Coverage limits

The scanner covers application dependencies and known vulnerabilities; Twira says it does not detect novel malware, typosquatting, dependency confusion, or malicious-maintainer attacks.twira.com · read 9 Oct 2026

Integration

An agent can call dependency scanning through the Diagnose MCP tool with the security profile.twira.com · read 9 Oct 2026

Intended users

Twira describes the product as a tool for developers and their AI agents, including security and compliance workflows.twira.com · read 9 Oct 2026

Not supported

Dart Pub, Hex, Conan, and CocoaPods are not yet supported; the page also excludes SBOM export, licence analysis, runtime monitoring, and container, OS, or firmware scanning.twira.com · read 9 Oct 2026

Offline use

The local vulnerability-data cache has a 24-hour TTL and supports offline or air-gapped scans after an initial sync.twira.com · read 9 Oct 2026

Output formats

Findings are available as structured JSON by default or SARIF 2.1.0.twira.com · read 9 Oct 2026

Privacy

Twira says indexing runs locally, indexed content is not telemetered, and LLM calls go through the customer's chosen provider and key.twira.com · read 9 Oct 2026

Purpose

Twira Dependency Vulnerabilities is a software composition analysis tool that scans lockfiles against OSV and reports vulnerabilities that pass installed-package and code-import reachability filters.twira.com · read 9 Oct 2026

Run locations

Twira says the same binary can run on a laptop, CI runner, or in an air-gapped environment.twira.com · read 9 Oct 2026

Supported ecosystems

It supports lockfiles for npm, Cargo, PyPI, Go, Maven, RubyGems, Packagist, NuGet, and Swift Package Manager.twira.com · read 9 Oct 2026

Suppression and audit

Twira says accepted-risk suppressions persist through lockfile changes and each detection is recorded in an append-only Merkle audit chain.twira.com · read 9 Oct 2026

Vulnerability data

Twira says its vulnerability data comes from OSV, which aggregates GHSA, RustSec, PYSEC, the Go vulnerability database, and other ecosystem feeds.twira.com · read 9 Oct 2026

Alternatives to Twira Dependency Vulnerabilities

D DepWardenWebWindows+4 S ScantistWebAPI+1 D DeepFilterNetWindowsMac+3 G GrypeWindowsMac+2 EL Endor LabsWebWindows+5 SO Snyk Open SourceWebWindows+3 S SocketWebWindows+5 SC Safety CLIWindowsMac+2

Every alternative, ranked