For vendors
AdvertiseTop spots, featured rows, home sponsor Get listedAdd a product we don't cover yet Claim a listingFree: verify the domain, then correct your page Vendor dashboardNumbers, orders and placements
Mobile US PressList your app
Vendor dashboard

Best Software Composition Analysis Software in 2026

Updated

In short: Accessibility Test Framework for Android is ranked #1 of 64 as of 4 October 2026, ahead of ReversingLabs Cloud Sandbox and Snyk Open Source. The best-ranked option with a free plan is Snyk Open Source. The lowest first paid tier on this page is Docker Desktop at $9/mo.

Software composition analysis software helps teams examine the components and dependencies used in their projects. Compare supported ecosystems and monitored projects to see what coverage is listed, then consider deployment options and pull request scanning within your development workflow. Reachability analysis and SBOM generation are additional capabilities to weigh when reviewing the available approaches. Accessibility Test Framework for Android, ReversingLabs Cloud Sandbox and Snyk Open Source appear among the entries, as do Sonatype Nexus Repository and Trivy. Free-plan availability and paid-from pricing provide further context as you compare listed features with the ecosystems and projects you need to monitor.

64 software composition analysis software ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.

64ranked
12free plans on this page
$9/molowest paid tier
4 Oct 2026last checked

Recognised 40% · Phone app 26% · Documented 20% · Free plan 14% of the score

  1. 1 Accessibility Test Framework for Android Android only RecognisedPhone appDocumentedFree plan 7.8Free Supported ecosystems: Go, Java, JavaScript, Python, Ruby, .NET, C++, Dart, Erlang, Elixir, Haskell, PHP, R, Rust, Swift, Julia, Lua, Nim, Perl; Alpine/APK, DPKG, RPM, Pacman, Homebrew, MacPorts, Chocolatey, Portage, Nix, Spack, Flatpak, Snap, OPKG, ZypperSBOM generation: YesReachability analysis: Yes
  2. 2 ReversingLabs Cloud Sandbox Android only RecognisedPhone appDocumentedFree plan 7.2 Supported ecosystems: npm, PyPI, RubyGems, NuGet, VS Code, PS Gallery, Docker, Amazon ECR, Hugging Face, Maven, Windows, Linux, macOS, containers, virtual machinesSBOM generation: YesReachability analysis: Yes
  3. 3 Snyk Open Source No phone app RecognisedPhone appDocumentedFree plan 6.4$25/mo Supported ecosystems: C/C++, Dart/Flutter, Elixir, Go, Java/Kotlin, JavaScript, .NET, PHP, Python, Ruby, Rust (limited), Scala, Swift/Objective-C, TypeScript; npm, pnpm, Yarn, Maven, Gradle, Pip, Poetry, pipenv and setup.pySBOM generation: YesReachability analysis: Yes
  4. 4 Sonatype Nexus Repository No phone app RecognisedPhone appDocumentedFree plan 6.4$162.50/mo Supported ecosystems: C++/Conan; Conda; Dart and Flutter/pub; Go/Go Modules; Hugging Face; Java/Maven, Gradle, Ivy; JavaScript/npm, yarn; .NET/NuGet; Objective-C/CocoaPods; PHP/Composer; Python/PyPI, Poetry, pipenv; R/CRAN; RPM/Yum and Fedora EPEL; Ruby/RubyGems and Bundler; Rust/Cargo; Swift/SwiftSBOM generation: YesReachability analysis: Yes
  5. 5 Trivy No phone app RecognisedPhone appDocumentedFree plan 6.4Free Supported ecosystems: Ruby, Python, PHP, Node.js, .NET, Java, Go, Rust, C/C++, Elixir, Dart, Swift, Julia, and operating-system packagesSBOM generation: Yes
  6. 6 Docker Desktop No phone app RecognisedPhone appDocumentedFree plan 6.3$9/mo SBOM generation: Yes
  7. 7 Endor Labs No phone app RecognisedPhone appDocumentedFree plan 6.3Free Supported ecosystems: C/C++, Go, Java, JavaScript, Kotlin, .NET (C#), PHP, Python, Ruby, Rust, Scala, Swift, TypeScript, BazelSBOM generation: YesReachability analysis: Yes
  8. 8 FOSSA No phone app RecognisedPhone appDocumentedFree plan 6.3$168392.50/mo Supported ecosystems: JavaScript/TypeScript, Java/Kotlin, Python, Go, Ruby, Rust, Clojure, Elixir, iOS/Objective-C/Swift, .NET, PHP, Dart, Erlang, Fortran, Haskell, PerlSBOM generation: YesReachability analysis: Yes
  9. 9 Grype No phone app RecognisedPhone appDocumentedFree plan 6.3Free Supported ecosystems: Alpine, Debian, Ubuntu, RHEL, SUSE, Amazon Linux, PyPI, npm, Maven, Go modules, Composer, NuGet, Pub, RubyGems, Crates, Swift, GitHub Actions, Bitnami, Conda, WordPress pluginsSBOM generation: Yes
  10. 10 Semgrep Supply Chain No phone app RecognisedPhone appDocumentedFree plan 6.3$30/mo Supported ecosystems: C# (NuGet); Dart (Pub); Go (Go modules); Java (Gradle, Maven); JavaScript/TypeScript (npm, Yarn, pnpm); Kotlin (Gradle, Maven); PHP (Composer); Python (pip, pip-tool, Pipenv, Poetry); Ruby (RubyGems); Rust (Cargo); Scala (Maven); Swift (SwiftPM)SBOM generation: YesReachability analysis: Yes
  11. 11 Socket No phone app RecognisedPhone appDocumentedFree plan 6.3$25/mo Supported ecosystems: JavaScript/TypeScript, Python, Go, Java, Ruby, .NET, Scala, Kotlin, Rust, PHP, Swift, C/C++, Julia, Dart, Elixir/Erlang, GitHub ActionsSBOM generation: YesReachability analysis: Yes
  12. 12 Xygeni No phone app RecognisedPhone appDocumentedFree plan 6.3Free Supported ecosystems: Maven, Gradle, npm, Yarn, Bower, .NET, Go, Python/Pip, PHP/Composer, Ruby, Dart/FlutterSBOM generation: YesReachability analysis: Yes
  13. 13 OSV-Scanner No phone app RecognisedPhone appDocumentedFree plan 6.2Free Supported ecosystems: C/C++, Dart, Elixir, Go, Haskell, Java, JavaScript, .NET, PHP, Python, R, Ruby, Rust; npm, pip, Maven, Go Modules, Cargo, Gem, Composer, NuGetSBOM generation: YesReachability analysis: Yes
  14. 14 Veracode DAST No phone app RecognisedPhone appDocumentedFree plan 5.8 Supported ecosystems: C#/.NET (DLL, NuGet); C/C++ (Make); Go (Dep, Glide, go get, Go modules, GoDep, GoVendor, Trash); Java (Ant, Gradle, JARs, Maven); JavaScript (Bower, NPM, Yarn); Kotlin (Gradle, JARs, Maven); Objective-C (CocoaPods); PHP (Composer); Python (pip, Pipenv, Poetry); Ruby (Bundler); Scala (JARs, SBT); Swift (CocoaPods); TypeScript (Bower, NPM, Yarn)SBOM generation: YesReachability analysis: Yes
  15. 15 Checkmarx API Security No phone app RecognisedPhone appDocumentedFree plan 5.6 Supported ecosystems: Java/Maven, JavaScript/TypeScript/NPM, .NET/NuGet, Python/PIP, PHP/Composer, Swift/iOS, Go, Ruby, C/C++/Conan, Unity, Perl/CPAN, Dart/PubSBOM generation: YesReachability analysis: Yes
  16. 16 Safeguard DAST No phone app RecognisedPhone appDocumentedFree plan 5.5 Supported ecosystems: npm, PyPI, Maven, Gradle, Go modules, Cargo, RubyGems, Composer, NuGet, HexSBOM generation: YesReachability analysis: Yes
  17. 17 Cycode SCA No phone app RecognisedPhone appDocumentedFree plan 5.4 Supported ecosystems: Java; Python; JavaScript/TypeScript; Go; C#; C++; other languagesSBOM generation: YesReachability analysis: Yes
  18. 18 DepWarden No phone app RecognisedPhone appDocumentedFree plan 5.4 Supported ecosystems: npm, PyPI, Maven, Gradle, Go, RubyGems, Cargo, NuGet, Composer, Dart (Pub), SwiftSBOM generation: YesReachability analysis: No
  19. 19 Safety CLI No phone app RecognisedPhone appDocumentedFree plan 5.4 Supported ecosystems: PythonSBOM generation: YesReachability analysis: Yes
  20. 20 Scantist No phone app RecognisedPhone appDocumentedFree plan 5.4 Supported ecosystems: Java, JavaScript, Perl, Go, Python, C#, C/C++, Ruby, PHP, Objective-C, SwiftSBOM generation: Yes
  21. 21 ts-scan No phone app RecognisedPhone appDocumentedFree plan 5.4 Supported ecosystems: Maven, Gradle, npm, PyPI, NuGet, Dart, Visual Basic 6, Go, Docker/SyftSBOM generation: YesReachability analysis: No
  22. 22 ZeroPath No phone app RecognisedPhone appDocumentedFree plan 5.4$1,000/mo
  23. 23 Black Duck SCA No phone app RecognisedPhone appDocumentedFree plan 5.3 Supported ecosystems: BitBake, Cargo, Carthage, CocoaPods, Conan, Conda, CPAN, CRAN, Dart, Go, Gradle, Hex, Ivy, Lerna, Maven, npm, NuGet, Packagist, PEAR, pip, pnpm, Poetry, RubyGems, SBT, Setuptools, Swift, Yarn, Xcode, OPAM, UV, RushSBOM generation: YesReachability analysis: Yes
  24. 24 Bomly CLI No phone app RecognisedPhone appDocumentedFree plan 5.3 Supported ecosystems: C++, Dart, .NET/NuGet, Elixir, GitHub Actions, Go, Maven, Gradle, npm, pnpm, Yarn, Bun, PHP/Composer, Python/pip/Pipenv/Poetry/uv, Ruby/Bundler, Rust/Cargo, Scala/SBT, Swift/CocoaPods/SwiftPM, plus Syft-backed ecosystemsSBOM generation: YesReachability analysis: Yes
  25. 25 cargo-audit No phone app RecognisedPhone appDocumentedFree plan 5.3 Supported ecosystems: Rust / CargoSBOM generation: NoReachability analysis: No

Is your app on this list?

Numbered spots on this list can be sponsored. They are labelled, and the editorial order and scores never change for payment.

#1 open#2 open#3 open#4 open#5 openClaim your listing — free

Questions about this list

Which software composition analysis software is ranked first on Samsung Mobile US Press?

Accessibility Test Framework for Android is ranked #1 of 64 with a score of 7.8. ReversingLabs Cloud Sandbox is second and Snyk Open Source third.

How many of these have a free plan?

12 of the 25 on this page publish a free plan on their own pricing pages.

Which is the cheapest paid option?

On this page, Docker Desktop has the lowest first paid tier we found: $9/mo.

How is this list ranked?

Ranked mobile-first: a phone app alongside the web or desktop product, a free tier and the depth of its documentation. Paid placements never change a rank.

More in Developer Tools

All developer tools lists
Accessibility Testing Software 168Log Management Software 107AI Coding Assistants 103Package Managers 93AI Agent Platforms 73Reverse Engineering Tools 73Browser Automation Tools 63Integrated Development Environments 62Artifact repository software 60Code Playground Software 58Network Monitoring 55Version Control Software 54