Best Software Composition Analysis Software in 2026
Updated
In short: Sonatype Nexus Repository is ranked #1 of 65 as of 4 October 2026, ahead of Xygeni and Snyk Open Source. The best-ranked option with a free plan is Xygeni. The lowest first paid tier on this page is Docker Desktop at $9/mo.
Software composition analysis tools help teams examine the components and dependencies used in their software projects. Compared on deployment options, monitored projects, pull request scanning, reachability analysis, SBOM generation and supported ecosystems, the entries offer several angles for assessing fit with your development workflow. Consider which ecosystems you use and how many projects you need to monitor; free plans and paid-from pricing also help frame the choice. Sonatype Nexus Repository, Xygeni and Snyk Open Source are among the options to examine, alongside Socket and Docker Desktop. Weigh the listed analysis capabilities against the coverage and process your team needs.
65 software composition analysis software ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
65ranked
13free plans on this page
$9/molowest paid tier
4 Oct 2026last checked
Input list Software Composition Analysis Software 25 channels on this page · 127 of 200 spec lines stated by the makers
Ch Tool Free planPaid fromSupported ecosystemsSBOM generationReachability analysisPull request scanningMonitored projectsDeployment options Spec sheet Score
01 Sonatype Nexus Repository Free planNoPaid fromnot statedSupported ecosystemsC++/Conan; Conda; Dart and Flutter/pub; Go/Go Modules; Hugging Face; Java/Maven, Gradle, Ivy; JavaScript/npm, yarn; .NET/NuGet; Objective-C/CocoaPods; PHP/Composer; Python/PyPI, Poetry, pipenv; R/CRAN; RPM/Yum and Fedora EPEL; Ruby/RubyGems and Bundler; Rust/Cargo; Swift/SwiftSBOM generationYesReachability analysisYesPull request scanningYesMonitored projectsnot statedDeployment optionshybrid 6/8spec lines stated 8.0
02 Xygeni Free planYesPaid fromnot statedSupported ecosystemsMaven, Gradle, npm, Yarn, Bower, .NET, Go, Python/Pip, PHP/Composer, Ruby, Dart/FlutterSBOM generationYesReachability analysisYesPull request scanningYesMonitored projects100 projectsDeployment optionshybrid 7/8spec lines stated 7.8
03 Snyk Open Source Free planYesPaid fromnot statedSupported ecosystemsC/C++, Dart/Flutter, Elixir, Go, Java/Kotlin, JavaScript, .NET, PHP, Python, Ruby, Rust (limited), Scala, Swift/Objective-C, TypeScript; npm, pnpm, Yarn, Maven, Gradle, Pip, Poetry, pipenv and setup.pySBOM generationYesReachability analysisYesPull request scanningYesMonitored projects100 projectsDeployment optionscloud 7/8spec lines stated 7.6
04 Socket Free planYesPaid fromnot statedSupported ecosystemsJavaScript/TypeScript, Python, Go, Java, Ruby, .NET, Scala, Kotlin, Rust, PHP, Swift, C/C++, Julia, Dart, Elixir/Erlang, GitHub ActionsSBOM generationYesReachability analysisYesPull request scanningYesMonitored projectsnot statedDeployment optionscloud 6/8spec lines stated 7.5
05 Docker Desktop Free planYesPaid fromnot statedSupported ecosystemsnot statedSBOM generationYesReachability analysisnot statedPull request scanningnot statedMonitored projectsnot statedDeployment optionsnot stated 2/8spec lines stated 7.4
06 FOSSA Free planYesPaid fromnot statedSupported ecosystemsJavaScript/TypeScript, Java/Kotlin, Python, Go, Ruby, Rust, Clojure, Elixir, iOS/Objective-C/Swift, .NET, PHP, Dart, Erlang, Fortran, Haskell, PerlSBOM generationYesReachability analysisYesPull request scanningYesMonitored projects10 projectsDeployment optionshybrid 7/8spec lines stated 7.4
07 Veracode DAST Free plannot statedPaid fromnot statedSupported ecosystemsC#/.NET (DLL, NuGet); C/C++ (Make); Go (Dep, Glide, go get, Go modules, GoDep, GoVendor, Trash); Java (Ant, Gradle, JARs, Maven); JavaScript (Bower, NPM, Yarn); Kotlin (Gradle, JARs, Maven); Objective-C (CocoaPods); PHP (Composer); Python (pip, Pipenv, Poetry); Ruby (Bundler); Scala (JARs, SBT); Swift (CocoaPods); TypeScript (Bower, NPM, Yarn)SBOM generationYesReachability analysisYesPull request scanningYesMonitored projectsnot statedDeployment optionscloud 5/8spec lines stated 7.4
08 Accessibility Test Framework for Android Free plannot statedPaid fromnot statedSupported ecosystemsGo, Java, JavaScript, Python, Ruby, .NET, C++, Dart, Erlang, Elixir, Haskell, PHP, R, Rust, Swift, Julia, Lua, Nim, Perl; Alpine/APK, DPKG, RPM, Pacman, Homebrew, MacPorts, Chocolatey, Portage, Nix, Spack, Flatpak, Snap, OPKG, ZypperSBOM generationYesReachability analysisYesPull request scanningnot statedMonitored projectsnot statedDeployment optionsself hosted 4/8spec lines stated 7.3
09 Endor Labs Free planYesPaid fromnot statedSupported ecosystemsC/C++, Go, Java, JavaScript, Kotlin, .NET (C#), PHP, Python, Ruby, Rust, Scala, Swift, TypeScript, BazelSBOM generationYesReachability analysisYesPull request scanningYesMonitored projectsnot statedDeployment optionshybrid 6/8spec lines stated 7.3
10 Semgrep Supply Chain Free planYesPaid fromnot statedSupported ecosystemsC# (NuGet); Dart (Pub); Go (Go modules); Java (Gradle, Maven); JavaScript/TypeScript (npm, Yarn, pnpm); Kotlin (Gradle, Maven); PHP (Composer); Python (pip, pip-tool, Pipenv, Poetry); Ruby (RubyGems); Rust (Cargo); Scala (Maven); Swift (SwiftPM)SBOM generationYesReachability analysisYesPull request scanningYesMonitored projects500 projectsDeployment optionshybrid 7/8spec lines stated 7.3
11 Trivy Free planYesPaid fromnot statedSupported ecosystemsRuby, Python, PHP, Node.js, .NET, Java, Go, Rust, C/C++, Elixir, Dart, Swift, Julia, and operating-system packagesSBOM generationYesReachability analysisnot statedPull request scanningnot statedMonitored projectsnot statedDeployment optionsself hosted 4/8spec lines stated 7.3
12 Grype Free planYesPaid fromnot statedSupported ecosystemsAlpine, Debian, Ubuntu, RHEL, SUSE, Amazon Linux, PyPI, npm, Maven, Go modules, Composer, NuGet, Pub, RubyGems, Crates, Swift, GitHub Actions, Bitnami, Conda, WordPress pluginsSBOM generationYesReachability analysisnot statedPull request scanningnot statedMonitored projectsnot statedDeployment optionsself hosted 4/8spec lines stated 7.2
13 ReversingLabs Cloud Sandbox Free planYesPaid fromnot statedSupported ecosystemsnpm, PyPI, RubyGems, NuGet, VS Code, PS Gallery, Docker, Amazon ECR, Hugging Face, Maven, Windows, Linux, macOS, containers, virtual machinesSBOM generationYesReachability analysisYesPull request scanningnot statedMonitored projectsnot statedDeployment optionshybrid 5/8spec lines stated 7.2
14 OSV-Scanner Free planYesPaid fromnot statedSupported ecosystemsC/C++, Dart, Elixir, Go, Haskell, Java, JavaScript, .NET, PHP, Python, R, Ruby, Rust; npm, pip, Maven, Go Modules, Cargo, Gem, Composer, NuGetSBOM generationYesReachability analysisYesPull request scanningYesMonitored projectsnot statedDeployment optionsself hosted 6/8spec lines stated 7.0
15 DeepFilterNet Free plannot statedPaid fromnot statedSupported ecosystemsnot statedSBOM generationnot statedReachability analysisnot statedPull request scanningnot statedMonitored projectsnot statedDeployment optionsnot stated 0/8spec lines stated 6.9
16 Mend SCA Free planNoPaid fromnot statedSupported ecosystemsC/C++/Conan, C#/.NET/NuGet, Go, Java/Maven/Gradle, JavaScript/npm/yarn/pnpm, PHP/Composer, Python/pip/Poetry/Conda/uv, Ruby/Bundler, Scala/sbt, Swift/SwiftPM/CocoaPods, Rust/Cargo, Haskell/Cabal, Elixir/Erlang/Hex, Bazel, OCamlSBOM generationYesReachability analysisYesPull request scanningYesMonitored projectsnot statedDeployment optionshybrid 6/8spec lines stated 6.8
17 ZeroPath Free planNoPaid from60/user/moSupported ecosystemsnot statedSBOM generationnot statedReachability analysisnot statedPull request scanningnot statedMonitored projectsnot statedDeployment optionsnot stated 2/8spec lines stated 6.8
18 Black Duck SCA Free plannot statedPaid fromnot statedSupported ecosystemsBitBake, Cargo, Carthage, CocoaPods, Conan, Conda, CPAN, CRAN, Dart, Go, Gradle, Hex, Ivy, Lerna, Maven, npm, NuGet, Packagist, PEAR, pip, pnpm, Poetry, RubyGems, SBT, Setuptools, Swift, Yarn, Xcode, OPAM, UV, RushSBOM generationYesReachability analysisYesPull request scanningYesMonitored projectsnot statedDeployment optionshybrid 5/8spec lines stated 6.4
19 ScanCode.io Free plannot statedPaid fromnot statedSupported ecosystemsnpm, PyPI, Maven, NuGet, RubyGems, Cargo, Composer, Conda, Docker; Java, Scala, Kotlin, Groovy, Clojure, JavaScript, TypeScript, Go, Rust, Python, DebianSBOM generationYesReachability analysisnot statedPull request scanningYesMonitored projectsnot statedDeployment optionsself hosted 4/8spec lines stated 6.4
20 Checkmarx API Security Free planNoPaid fromnot statedSupported ecosystemsJava/Maven, JavaScript/TypeScript/NPM, .NET/NuGet, Python/PIP, PHP/Composer, Swift/iOS, Go, Ruby, C/C++/Conan, Unity, Perl/CPAN, Dart/PubSBOM generationYesReachability analysisYesPull request scanningYesMonitored projectsnot statedDeployment optionscloud 6/8spec lines stated 6.3
21 Safety CLI Free planYesPaid from25/user/moSupported ecosystemsPythonSBOM generationYesReachability analysisYesPull request scanningnot statedMonitored projects25 projectsDeployment optionshybrid 7/8spec lines stated 6.3
22 Bomly CLI Free planYesPaid fromnot statedSupported ecosystemsC++, Dart, .NET/NuGet, Elixir, GitHub Actions, Go, Maven, Gradle, npm, pnpm, Yarn, Bun, PHP/Composer, Python/pip/Pipenv/Poetry/uv, Ruby/Bundler, Rust/Cargo, Scala/SBT, Swift/CocoaPods/SwiftPM, plus Syft-backed ecosystemsSBOM generationYesReachability analysisYesPull request scanningYesMonitored projectsnot statedDeployment optionsself hosted 6/8spec lines stated 6.2
23 OpenSCA Free planYesPaid fromnot statedSupported ecosystemsJava/Maven, Java/Gradle, JavaScript/NPM, PHP/Composer, Ruby/gem, Golang/Go mod, Rust/cargo, Erlang/Rebar, Python/PipSBOM generationYesReachability analysisnot statedPull request scanningYesMonitored projectsnot statedDeployment optionshybrid 5/8spec lines stated 6.2
24 SBOM Observer Free planNoPaid fromnot statedSupported ecosystemsC/C++/Conan; Dart/Pub; Elixir/Hex; Erlang/Hex; Go; Java/Maven; .NET/NuGet; Node.js/npm; PHP/Composer; Python/PyPI/Pip; Ruby/RubyGems; Rust/Cargo; Swift/CocoaPodsSBOM generationYesReachability analysisnot statedPull request scanningnot statedMonitored projects2 projectsDeployment optionshybrid 5/8spec lines stated 6.2
25 Twira Dependency Vulnerabilities Free planYesPaid fromnot statedSupported ecosystemsnpm, Cargo, PyPI, Go, Maven, RubyGems, Packagist, NuGet, Swift Package ManagerSBOM generationNoReachability analysisYesPull request scanningnot statedMonitored projectsnot statedDeployment optionsself hosted 5/8spec lines stated 6.2
Is your tool on this list?
Numbered spots on this list can be sponsored. They are labelled, and the editorial order and scores never change for payment.
Questions about this list
Which software composition analysis software is ranked first on Specifiction?
Sonatype Nexus Repository is ranked #1 of 65 with a score of 8.0. Xygeni is second and Snyk Open Source third.
How many of these have a free plan?
13 of the 25 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, Docker Desktop has the lowest first paid tier we found: $9/mo.
How is this list ranked?
Ranked on what each maker publishes, the fullest spec sheet first: how deeply the product is documented, the platforms it runs on, a free tier or trial to test it, and its standing. Paid placements never change a rank.
More in Developer Tools
All developer tools listsAccessibility Testing Software 168Log Management Software 107AI Coding Assistants 103Package Managers 93AI Agent Platforms 73Reverse Engineering Tools 73Browser Automation Tools 63Integrated Development Environments 62Artifact repository software 60Code Playground Software 58Network Monitoring 56Version Control Software 54