Software Composition Analysis Tools
Software supply chain security tools generate SBOMs, sign artifacts, scan dependencies for known vulnerabilities, and verify component provenance to protect against tampering and compromised packages.
Software in Software Composition Analysis Tools
12 toolsNo tools in this category match the selected filters.
| Tool | License | Platforms | Pricing |
|---|---|---|---|
| Chainguard Images Hardened minimal container images rebuilt from source daily with SLSA provenance and SBOMs. | Proprietary | Linux, Web | Free / Commercial |
| Cosign Command-line tool for Sigstore artifact and container image signatures, with support for keyless signing and SBOM verification. | Apache-2.0 | Linux, macOS, Windows | Open Source |
| Endor Labs SCA platform using function-level reachability analysis to prioritize only exploitable dependency findings. | Proprietary | Web, Linux, macOS, Windows | Free / Commercial |
| Grype Vulnerability scanner for container images and filesystems that identifies CVEs in packages, dependencies, and operating system distributions. | Apache-2.0 | Linux, macOS, Windows | Open Source |
| in-toto CNCF supply-chain attestation framework that records and verifies each build step using signed metadata to protect software artifact integrity. | Apache-2.0 | Linux, macOS | Open Source |
| OpenSSF Scorecard Automated posture assessment that scores open-source projects on dependency updates, maintenance, code review, and supply-chain risk practices. | Apache-2.0 | Linux, macOS | Open Source |
| OSV-Scanner Google's open-source software composition analyzer that maps project dependencies to vulnerabilities via the OSV database and to license risks via deps.dev. | Apache-2.0 | Linux, macOS, Windows | Open Source |
| OWASP Dependency-Check Software composition analysis tool that checks project dependencies against the National Vulnerability Database for known CVEs. | Apache-2.0 | Linux, macOS, Windows | Open Source |
| OWASP Dependency-Track OWASP flagship platform that monitors SBOMs continuously for vulnerabilities, licenses, and policy. | Apache-2.0 | Linux, Web | Open Source |
| Retire.js Detects vulnerable JavaScript and Node.js libraries and generates SBOMs through a CLI scanner with optional proxy integrations. | Apache-2.0 | Linux, Windows, macOS | Open Source |
| Socket Malicious package detection that inspects dependency behavior across npm, PyPI, Go, and other registries. | Proprietary | Web | Freemium |
| Syft Open source CLI that generates SBOMs from container images, filesystems, and source projects. | Apache-2.0 | Linux, macOS, Windows | Open Source |
About Software Composition Analysis Tools
Software supply chain security tools protect the integrity of software from development through deployment. The category covers SBOM (software bill of materials) generators that produce machine-readable lists of all components in a software project, artifact signing tools that cryptographically verify build provenance, dependency scanners that check packages against vulnerability databases, and provenance verification tools that confirm artifacts were built by trusted build systems. SBOM tools like Syft and OSV-Scanner enumerate dependencies in container images and project files, producing SPDX or CycloneDX format reports. Signing tools like Cosign and in-toto attach cryptographic signatures to container images and build artifacts, so consumers can verify that images were not tampered with after build time. Dependency scanners like Trivy, Grype, OWASP Dependency-Check, and OSV-Scanner match project dependencies against vulnerability data from sources such as the NVD and OSV to find known CVEs. In the SolarWinds Orion incident, one of the initial access vectors was a supply chain compromise of a DLL in Orion products. Frameworks like SLSA (Supply-chain Levels for Software Artifacts) provide tiered requirements for build integrity, and tools in this category help organizations meet those requirements.
Covered Topics
In This Catalog
- This category lists 12 tools: 9 open source, 2 free / commercial, and 1 freemium.
- By platform, 11 run on Linux, 7 on Windows, 9 on macOS, and 4 on the web.
- The most common license among the open-source tools is Apache-2.0 (9 tools).
Frequently Asked Questions
What is Software Composition Analysis Tools?→
Software supply chain security tools generate SBOMs, sign artifacts, scan dependencies for known vulnerabilities, and verify component provenance to protect against tampering and compromised packages.
What topics does the Software Composition Analysis Tools category cover?→
SBOM Generation & Management, Cryptographic Artifact Signing, Dependency Vulnerability Auditing, Provenance Verification (SLSA), Build Pipeline Integrity
Which Software Composition Analysis tools are open source?→
9 of the 12 tools in this category are open source: Cosign, Grype, in-toto, OpenSSF Scorecard, OSV-Scanner, OWASP Dependency-Check, OWASP Dependency-Track, Retire.js, and Syft.