AppSecNews

SCA

Software Composition Analysis

Identify open-source dependencies and match them against known vulnerability and license data.

28 tools profiled

How it differs Checks the open source packages you depend on for known vulnerabilities and license obligations. Flaws in code you wrote are SAST territory.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals
Clear

3 tools match

Active Container Clear all

  • Anchore Grype

    Anchore

    SCA

    An open source scanner that matches the contents of container images, filesystems and SBOMs against operating system and language ecosystem vulnerability feeds.

    Open source
    Established

  • cdxgen

    CycloneDX

    SCA

    A command line SBOM generator that produces CycloneDX bills of materials from source projects, container images, binaries and operating system packages across many ecosystems.

    Open source
    Established

  • Chainguard

    Chainguard

    SCA

    A supplier of minimal, continuously rebuilt container images and language dependencies that ship with signatures, provenance and SBOMs to cut vulnerability backlog at the source.

    Commercial, free tier
    Growing

  • Anchore Grype

    Anchore

    An open source scanner that matches the contents of container images, filesystems and SBOMs against operating system and language ecosystem vulnerability feeds.

    Open source Established
    SCA

  • cdxgen

    CycloneDX

    A command line SBOM generator that produces CycloneDX bills of materials from source projects, container images, binaries and operating system packages across many ecosystems.

    Open source Established
    SCA

  • Chainguard

    Chainguard

    A supplier of minimal, continuously rebuilt container images and language dependencies that ship with signatures, provenance and SBOMs to cut vulnerability backlog at the source.

    Commercial, free tier Growing
    SCA
Tick up to 4 tools above.