Best Software Composition Analysis Software in 2026
Updated
54 software composition analysis software ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
54ranked
0free plans on this page
$1,000/molowest paid tier
3 Oct 2026last checked
| # | Platform | Score | Why | From | Free plan | Paid from | Supported ecosystems | |
|---|---|---|---|---|---|---|---|---|
| 26 | ScanCode.io | 5.9 | RecognisedAPIDocumented | — | — | — | npm, PyPI, Maven, NuGet, RubyGems, Cargo, Composer, Conda, Docker; Java, Scala, Kotlin, Groovy, Clojure, JavaScript, TypeScript, Go, Rust, Python, Debian | View |
| 27 |  CVE Binary Tool | 5.9 | RecognisedAPIDocumented | — | Yes | — | Dart (pubspec.lock); Go (go.mod); Java (pom.xml, JAR/WAR/EAR); JavaScript (package-lock.json, yarn.lock); OpenWrt opkg (.control); Perl (cpanfile); Python (requirements.txt, PKG-INFO, METADATA, .whl, .egg); Rust (Cargo.lock); Ruby (Gemfile.lock); R (renv.lock); Swift (Package.resolved); Windows PE (.pyd) | View |
| 28 |  Vulert | 5.8 | RecognisedAPIDocumented | — | No | — | Java, JavaScript, PHP, Python, Go, Rust, Ruby, Dart, C/C++, Elixir, CycloneDX, SPDX | View |
| 29 | OpenHack Supply Chain | 5.8 | RecognisedAPIDocumented | — | Yes | — | npm, PyPI | View |
| 30 |  ts-scan | 5.8 | RecognisedAPIDocumented | — | Yes | — | Maven, Gradle, npm, PyPI, NuGet, Dart, Visual Basic 6, Go, Docker/Syft | View |
| 31 |  Cycode SCA | 5.7 | RecognisedAPIDocumented | — | — | — | Java; Python; JavaScript/TypeScript; Go; C#; C++; other languages | View |
| 32 |  Grype | 5.7 | RecognisedAPIDocumented | — | Yes | — | Alpine, Debian, Ubuntu, RHEL, SUSE, Amazon Linux, PyPI, npm, Maven, Go modules, Composer, NuGet, Pub, RubyGems, Crates, Swift, GitHub Actions, Bitnami, Conda, WordPress plugins | View |
| 33 | SBOM Observer | 5.6 | RecognisedAPIDocumented | — | No | — | C/C++/Conan; Dart/Pub; Elixir/Hex; Erlang/Hex; Go; Java/Maven; .NET/NuGet; Node.js/npm; PHP/Composer; Python/PyPI/Pip; Ruby/RubyGems; Rust/Cargo; Swift/CocoaPods | View |
| 34 | ComplyVigilance SCA | 5.6 | RecognisedAPIDocumented | — | — | — | npm, yarn, pip, PyPI, Poetry, Maven, Gradle, NuGet, Cargo, Go Modules, vcpkg, Conan, Pkg.jl, Hardhat, Truffle, Foundry, Docker Hub, OCI registries; C, C++, C#, Java, Python, JavaScript, TypeScript, Go, Rust, Solidity, Julia | View |
| 35 |  Twira Dependency Vulnerabilities | 5.6 | RecognisedAPIDocumented | — | Yes | — | npm, Cargo, PyPI, Go, Maven, RubyGems, Packagist, NuGet, Swift Package Manager | View |
| 36 | Anchore Enterprise | 5.5 | RecognisedAPIDocumented | — | No | — | RPM, DEB, APK, ALPM, Portage, Microsoft KB patches, C/C++, Dart, .NET, Elixir, Erlang, Go, Haskell, Java, JavaScript, Jenkins Plugins, Lua, Nix, Objective-C, OCaml, PHP, Python, R, Ruby, Rust, Swift, SWI-Prolog, Bitnami, GitHub Actions, Homebrew, Terraform, WordPress plugins | View |
| 37 | Insignary Clarity | 5.5 | RecognisedAPIDocumented | — | No | — | — | View |
| 38 |  lockhawk | 5.5 | RecognisedAPIDocumented | — | Yes | — | npm, Yarn, pnpm | View |
| 39 |  pip-audit | 5.4 | RecognisedAPIDocumented | — | Yes | — | Python packages; pip; requirements files; pyproject.toml; pylock.*.toml | View |
| 40 |  Retire.js | 5.4 | RecognisedAPIDocumented | — | Yes | — | JavaScript; Node.js modules; npm | View |
| 41 | ZeroPath | 5.3 | RecognisedAPIDocumented | $1,000/mo | No | 60 /user/mo | — | View |
| 42 | Eclipse Steady | 5.3 | RecognisedAPIDocumented | — | — | — | Java, Python, Maven, Gradle | View |
| 43 | SBOM Studio | 5.3 | RecognisedAPIDocumented | — | — | — | — | View |
| 44 |  Clair | 5.3 | RecognisedAPIDocumented | — | Yes | — | — | View |
| 45 | Sandworm Audit | 5.3 | RecognisedAPIDocumented | — | Yes | — | npm, Yarn, pnpm, Composer | View |
| 46 | deppbot | 5.3 | RecognisedAPIDocumented | — | Yes | — | RubyGems, Bundler, Gemfile, Gemfile.lock | View |
| 47 | govulncheck | 5.2 | RecognisedAPIDocumented | — | — | — | Go | View |
| 48 |  Nancy | 5.2 | RecognisedAPIDocumented | — | Yes | — | Go (go.mod) | View |
| 49 |  cargo-deny | 5.0 | RecognisedAPIDocumented | — | — | — | Rust; Cargo; crates.io; Git registries; Git repositories | View |
| 50 |  VersionEye | 4.9 | RecognisedAPIDocumented | — | No | — | Python, Ruby, Node.js, PHP; npm, Composer, Bundler, pip | View |
More in Developer Tools
All developer tools listsAccessibility Testing Software 131AI Coding Assistants 101Package Managers 93Log Management Software 80Artifact repository software 62Continuous Integration Software 51Development Environment Managers 50Code review software 48Uptime Monitoring Software 48DevOps analytics software 46Version Control Software 46Container Registries 45