Skip to content
SPECIFICTION
Get listed

Eclipse Steady

eclipse-steady.github.io

Free plan WebmacOSLinuxAPISelf-hosted
Visit eclipse-steady.github.io
Spec score 8.6 #5 of 65 in Software Composition Analysis Software

What it is

Eclipse Steady is an open-source tool for analyzing Java and Python applications that depend on open-source components with known vulnerabilities. It combines static and dynamic analysis to determine whether vulnerable code is reachable or executed in an application context, using a code-focused, usage-based assessment rather than metadata alone. The project includes Java and Python client tools, server-side REST services, and web frontends. Documentation covers Java scans for Maven, Gradle, and command-line workflows, plus Python command-line scanning. Jenkins and other continuous-integration systems can automate scans. Java Maven reports can be written as HTML, XML, or JSON. Its backend runs as a Docker Compose application during scans, storing vulnerability information and results. Initial setup processes code-level vulnerability data, followed by daily delta updates. Eclipse Steady is free under Apache License 2.0; version 3.2.5 is labeled an Incubator Project.

Spec sheet

Purpose
Eclipse Steady analyzes Java and Python applications for dependencies with known vulnerabilities and helps developers mitigate them.Read 11 Oct 2026 · eclipse-steady.github.io
Audience
The documented workflow has developers scan Java or Python applications regularly and assess findings in the apps web frontend.Read 11 Oct 2026 · eclipse-steady.github.io
Deployment
The backend is a Docker Compose application that stores vulnerability information and scan results, and must be running during scans.Read 4 Oct 2026 · eclipse-steady.github.io
Support
The support page directs users to tutorials, the user guide, FAQs, and GitHub issues for bug reports.Read 11 Oct 2026 · eclipse-steady.github.io
License
The project says it was open-sourced in October 2018 under the Apache License v.2.0.Read 4 Oct 2026 · eclipse-steady.github.io
Analysis
It combines static and dynamic analysis to collect evidence about whether vulnerable code is reachable or executed in an application context.Read 4 Oct 2026 · eclipse-steady.github.io
Assessment
Its code-centric, usage-based approach is intended to support more accurate detection and assessment than approaches relying on metadata.Read 4 Oct 2026 · eclipse-steady.github.io
Build integrations
The documentation provides scanning tutorials for Java applications built with Maven or Gradle and Python applications using the CLI.Read 11 Oct 2026 · eclipse-steady.github.io
CI automation
The user guide describes automating scans with Jenkins or other continuous integration systems.Read 11 Oct 2026 · eclipse-steady.github.io
CI integration
The documentation includes guidance for automating scans with Jenkins and other continuous integration systems.Read 4 Oct 2026 · eclipse-steady.github.io
Components
The project comprises client-side tools for Java and Python, server-side RESTful services, and web frontends.Read 11 Oct 2026 · eclipse-steady.github.io
Deployment caveat
The Docker deployment tutorial says its demonstrated setup is not intended for productive scenarios because of security and scalability concerns.Read 4 Oct 2026 · eclipse-steady.github.io
Detection method
Its code-centric, usage-based approach combines static and dynamic analysis to assess vulnerable dependencies.Read 11 Oct 2026 · eclipse-steady.github.io
Java support
The documentation provides Java scanning tutorials for Maven, Gradle, and command-line use.Read 4 Oct 2026 · eclipse-steady.github.io
License and origin
Initially developed by SAP Security Research, Eclipse Steady was open-sourced in October 2018 under Apache License 2.0.Read 11 Oct 2026 · eclipse-steady.github.io
Project status
The maker's site labels Eclipse Steady version 3.2.5 as an Incubator Project.Read 4 Oct 2026 · eclipse-steady.github.io
Python support
The documentation provides a command-line scanning workflow for Python applications.Read 4 Oct 2026 · eclipse-steady.github.io
Reports
The Gradle tutorial says summary reports can be written in HTML, XML, and JSON, and a build exception is thrown by default when the application includes a library with known vulnerabilities.Read 11 Oct 2026 · eclipse-steady.github.io
Self-hosting
The project documents deploying its backend services with Docker Compose, while warning that the documented setup is for demonstration and not productive scenarios due to security and scalability concerns.Read 11 Oct 2026 · eclipse-steady.github.io
Vulnerability data
The Docker deployment guide says vulnerability data is imported from the project knowledge base, updated daily after the initial import, and may take up to two hours to process initially.Read 11 Oct 2026 · eclipse-steady.github.io

Plans and prices

Open-source software Free Apache License 2.0 Read 11 Oct 2026 · eclipse-steady.github.io

Every Eclipse Steady plan and price →

Strong points and limits

Strong points

  • Static and dynamic reachability analysis
  • Supports Java and Python scanning
  • Maven, Gradle, and CLI workflows
  • Jenkins automation guidance
  • HTML, XML, and JSON reports

Limits

  • Backend must run during scans
  • Documented Docker setup is not for production
  • Version 3.2.5 is labeled an Incubator Project

Who it suits

It suits developers scanning Java or Python applications, including Maven and Gradle projects, who want reachability analysis and CI automation. Teams must be prepared to run the Docker Compose backend themselves.

Verdict

Eclipse Steady provides free, code-level vulnerability assessment for Java and Python applications, with documented build and CI workflows. Its self-hosted backend and demonstration-only deployment guidance matter when planning production use.

Where Specifiction places it

Alternatives to Eclipse SteadyAll alternatives →