Best Software Composition Analysis Software in 2026
Updated
56 software composition analysis software ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
56ranked
1free plans on this page
$1,000/molowest paid tier
4 Oct 2026last checked
Recognised 40% · Phone app 26% · Documented 20% · Free plan 14% of the score
- 26 depproof No phone app RecognisedPhone appDocumentedFree plan 6.1 Supported ecosystems: Maven, Gradle, npm, pnpm, yarn, bun, PyPI, Go modulesSBOM generation: Yes
- 27 Vulert No phone app RecognisedPhone appDocumentedFree plan 6.0 Supported ecosystems: Java, JavaScript, PHP, Python, Go, Rust, Ruby, Dart, C/C++, Elixir, CycloneDX, SPDXSBOM generation: YesReachability analysis: Yes
- 28 Meterian BOSS No phone app RecognisedPhone appDocumentedFree plan 6.0 Supported ecosystems: Binaries, C/C++, Clojure, Dart/Flutter, Elixir, Generic, Golang, Java/Kotlin/Scala, JavaScript, .NET, NodeJS, Perl, PHP, Python, R, Ruby, Rust, Swift/Objective-CSBOM generation: Yes
- 29 Cycode SCA No phone app RecognisedPhone appDocumentedFree plan 6.0 Supported ecosystems: Java; Python; JavaScript/TypeScript; Go; C#; C++; other languagesSBOM generation: YesReachability analysis: Yes
- 30 ZeroPath No phone app RecognisedPhone appDocumentedFree plan 6.0$1,000/mo
- 31 SBOM Observer No phone app RecognisedPhone appDocumentedFree plan 5.9 Supported ecosystems: C/C++/Conan; Dart/Pub; Elixir/Hex; Erlang/Hex; Go; Java/Maven; .NET/NuGet; Node.js/npm; PHP/Composer; Python/PyPI/Pip; Ruby/RubyGems; Rust/Cargo; Swift/CocoaPodsSBOM generation: Yes
- 32 ComplyVigilance SCA No phone app RecognisedPhone appDocumentedFree plan 5.9 Supported ecosystems: npm, yarn, pip, PyPI, Poetry, Maven, Gradle, NuGet, Cargo, Go Modules, vcpkg, Conan, Pkg.jl, Hardhat, Truffle, Foundry, Docker Hub, OCI registries; C, C++, C#, Java, Python, JavaScript, TypeScript, Go, Rust, Solidity, JuliaSBOM generation: Yes
- 33 Safety CLI No phone app RecognisedPhone appDocumentedFree plan 5.9 Supported ecosystems: PythonSBOM generation: YesReachability analysis: Yes
- 34 OSV-SCALIBR No phone app RecognisedPhone appDocumentedFree plan 5.8 Supported ecosystems: Go, Java, JavaScript, Python, Ruby, .NET, C++, Dart, Erlang, Elixir, Haskell, PHP, R, Rust, Swift, Julia, Lua, Nim, Perl; Alpine/APK, DPKG, RPM, Pacman, Homebrew, MacPorts, Chocolatey, Portage, Nix, Spack, Flatpak, Snap, OPKG, ZypperSBOM generation: YesReachability analysis: Yes
- 35 Anchore Enterprise No phone app RecognisedPhone appDocumentedFree plan 5.7 Supported ecosystems: RPM, DEB, APK, ALPM, Portage, Microsoft KB patches, C/C++, Dart, .NET, Elixir, Erlang, Go, Haskell, Java, JavaScript, Jenkins Plugins, Lua, Nix, Objective-C, OCaml, PHP, Python, R, Ruby, Rust, Swift, SWI-Prolog, Bitnami, GitHub Actions, Homebrew, Terraform, WordPress pluginsSBOM generation: Yes
- 36 Insignary Clarity No phone app RecognisedPhone appDocumentedFree plan 5.7 SBOM generation: YesReachability analysis: Yes
- 37 CVE Binary Tool No phone app RecognisedPhone appDocumentedFree plan 5.7 Supported ecosystems: Dart (pubspec.lock); Go (go.mod); Java (pom.xml, JAR/WAR/EAR); JavaScript (package-lock.json, yarn.lock); OpenWrt opkg (.control); Perl (cpanfile); Python (requirements.txt, PKG-INFO, METADATA, .whl, .egg); Rust (Cargo.lock); Ruby (Gemfile.lock); R (renv.lock); Swift (Package.resolved); Windows PE (.pyd)SBOM generation: Yes
- 38 ts-scan No phone app RecognisedPhone appDocumentedFree plan 5.7 Supported ecosystems: Maven, Gradle, npm, PyPI, NuGet, Dart, Visual Basic 6, Go, Docker/SyftSBOM generation: YesReachability analysis: No
- 39 DeepFilterNet No phone app RecognisedPhone appDocumentedFree plan 5.7Free
- 40 OpenHack Supply Chain No phone app RecognisedPhone appDocumentedFree plan 5.6 Supported ecosystems: npm, PyPISBOM generation: Yes
- 41 Eclipse Steady No phone app RecognisedPhone appDocumentedFree plan 5.5 Supported ecosystems: Java, Python, Maven, GradleReachability analysis: Yes
- 42 SBOM Studio No phone app RecognisedPhone appDocumentedFree plan 5.5 SBOM generation: Yes
- 43 govulncheck No phone app RecognisedPhone appDocumentedFree plan 5.4 Supported ecosystems: GoSBOM generation: YesReachability analysis: Yes
- 44 Twira Dependency Vulnerabilities No phone app RecognisedPhone appDocumentedFree plan 5.4 Supported ecosystems: npm, Cargo, PyPI, Go, Maven, RubyGems, Packagist, NuGet, Swift Package ManagerSBOM generation: NoReachability analysis: Yes
- 45 lockhawk No phone app RecognisedPhone appDocumentedFree plan 5.3 Supported ecosystems: npm, Yarn, pnpmSBOM generation: NoReachability analysis: No
- 46 pip-audit No phone app RecognisedPhone appDocumentedFree plan 5.2 Supported ecosystems: Python packages; pip; requirements files; pyproject.toml; pylock.*.tomlSBOM generation: Yes
- 47 cargo-deny No phone app RecognisedPhone appDocumentedFree plan 5.1 Supported ecosystems: Rust; Cargo; crates.io; Git registries; Git repositories
- 48 Retire.js No phone app RecognisedPhone appDocumentedFree plan 5.1 Supported ecosystems: JavaScript; Node.js modules; npmSBOM generation: Yes
- 49 Sandworm Audit No phone app RecognisedPhone appDocumentedFree plan 5.1 Supported ecosystems: npm, Yarn, pnpm, ComposerSBOM generation: No
- 50 Clair No phone app RecognisedPhone appDocumentedFree plan 5.0
Compare all 25 in a table
| # | App | Score | Free plan | From | Free plan | Paid from | Supported ecosystems | SBOM generation |
|---|---|---|---|---|---|---|---|---|
| 26 | depproof | 6.1 | No | — | Yes | — | Maven, Gradle, npm, pnpm, yarn, bun, PyPI, Go modules | Yes |
| 27 | Vulert | 6.0 | No | — | No | — | Java, JavaScript, PHP, Python, Go, Rust, Ruby, Dart, C/C++, Elixir, CycloneDX, SPDX | Yes |
| 28 | Meterian BOSS | 6.0 | No | — | Yes | — | Binaries, C/C++, Clojure, Dart/Flutter, Elixir, Generic, Golang, Java/Kotlin/Scala, JavaScript, .NET, NodeJS, Perl, PHP, Python, R, Ruby, Rust, Swift/Objective-C | Yes |
| 29 | Cycode SCA | 6.0 | No | — | — | — | Java; Python; JavaScript/TypeScript; Go; C#; C++; other languages | Yes |
| 30 | ZeroPath | 6.0 | No | $1,000/mo | No | 60 /user/mo | — | — |
| 31 | SBOM Observer | 5.9 | No | — | No | — | C/C++/Conan; Dart/Pub; Elixir/Hex; Erlang/Hex; Go; Java/Maven; .NET/NuGet; Node.js/npm; PHP/Composer; Python/PyPI/Pip; Ruby/RubyGems; Rust/Cargo; Swift/CocoaPods | Yes |
| 32 | ComplyVigilance SCA | 5.9 | No | — | — | — | npm, yarn, pip, PyPI, Poetry, Maven, Gradle, NuGet, Cargo, Go Modules, vcpkg, Conan, Pkg.jl, Hardhat, Truffle, Foundry, Docker Hub, OCI registries; C, C++, C#, Java, Python, JavaScript, TypeScript, Go, Rust, Solidity, Julia | Yes |
| 33 | Safety CLI | 5.9 | No | — | Yes | 25 /user/mo | Python | Yes |
| 34 | OSV-SCALIBR | 5.8 | No | — | — | — | Go, Java, JavaScript, Python, Ruby, .NET, C++, Dart, Erlang, Elixir, Haskell, PHP, R, Rust, Swift, Julia, Lua, Nim, Perl; Alpine/APK, DPKG, RPM, Pacman, Homebrew, MacPorts, Chocolatey, Portage, Nix, Spack, Flatpak, Snap, OPKG, Zypper | Yes |
| 35 | Anchore Enterprise | 5.7 | No | — | No | — | RPM, DEB, APK, ALPM, Portage, Microsoft KB patches, C/C++, Dart, .NET, Elixir, Erlang, Go, Haskell, Java, JavaScript, Jenkins Plugins, Lua, Nix, Objective-C, OCaml, PHP, Python, R, Ruby, Rust, Swift, SWI-Prolog, Bitnami, GitHub Actions, Homebrew, Terraform, WordPress plugins | Yes |
| 36 | Insignary Clarity | 5.7 | No | — | No | — | — | Yes |
| 37 | CVE Binary Tool | 5.7 | No | — | Yes | — | Dart (pubspec.lock); Go (go.mod); Java (pom.xml, JAR/WAR/EAR); JavaScript (package-lock.json, yarn.lock); OpenWrt opkg (.control); Perl (cpanfile); Python (requirements.txt, PKG-INFO, METADATA, .whl, .egg); Rust (Cargo.lock); Ruby (Gemfile.lock); R (renv.lock); Swift (Package.resolved); Windows PE (.pyd) | Yes |
| 38 | ts-scan | 5.7 | No | — | Yes | — | Maven, Gradle, npm, PyPI, NuGet, Dart, Visual Basic 6, Go, Docker/Syft | Yes |
| 39 | DeepFilterNet | 5.7 | Free plan | Free | — | — | — | — |
| 40 | OpenHack Supply Chain | 5.6 | No | — | Yes | — | npm, PyPI | Yes |
| 41 | Eclipse Steady | 5.5 | No | — | — | — | Java, Python, Maven, Gradle | — |
| 42 | SBOM Studio | 5.5 | No | — | — | — | — | Yes |
| 43 | govulncheck | 5.4 | No | — | — | — | Go | Yes |
| 44 | Twira Dependency Vulnerabilities | 5.4 | No | — | Yes | — | npm, Cargo, PyPI, Go, Maven, RubyGems, Packagist, NuGet, Swift Package Manager | No |
| 45 | lockhawk | 5.3 | No | — | Yes | — | npm, Yarn, pnpm | No |
| 46 | pip-audit | 5.2 | No | — | Yes | — | Python packages; pip; requirements files; pyproject.toml; pylock.*.toml | Yes |
| 47 | cargo-deny | 5.1 | No | — | — | — | Rust; Cargo; crates.io; Git registries; Git repositories | — |
| 48 | Retire.js | 5.1 | No | — | Yes | — | JavaScript; Node.js modules; npm | Yes |
| 49 | Sandworm Audit | 5.1 | No | — | Yes | — | npm, Yarn, pnpm, Composer | No |
| 50 | Clair | 5.0 | No | — | Yes | — | — | — |
More in Developer Tools
All developer tools listsAccessibility Testing Software 131AI Coding Assistants 101Package Managers 93Log Management Software 80AI Agent Platforms 68Artifact repository software 62Continuous Integration Software 52Development Environment Managers 50Code review software 49Container Registries 49Version Control Software 49Uptime Monitoring Software 48