Skip to content
SPECIFICTION
Get listed

GUAC

guac.sh

Free plan Open source WebWindowsmacOSLinuxAPISelf-hosted
Visit guac.sh
Spec score 8.8 #2 of 24 in Software Supply Chain Security Software

What it is

GUAC ingests software metadata, including software bills of materials, and connects it into a queryable view of supply-chain relationships. That portfolio-level view lets developers, operations and security practitioners, and Open Source Program Offices examine dependencies across software rather than one SBOM at a time. Teams can look for vulnerable, deprecated, unsupported, or duplicated dependencies and identify risky upstreams using OpenSSF Scorecard. APIs and a visualization tool support queries and exploration. GUAC documents SPDX and CycloneDX SBOM formats, with graph enrichment from OSV for vulnerability data, ClearlyDefined for license information, and Deps.dev for dependency information. Its GraphQL server can use in-memory storage or PostgreSQL for persistence. Collectors can read or watch files, storage buckets, and Git repositories; the filesystem collector is stable, while other collectors are experimental. Setup uses Docker Compose and requires Docker, Docker Compose, and jq. The project is an OpenSSF Incubating Project. GUAC is free and open source: its code is under the MIT license, and documentation content is under CC BY 4.0.

Spec sheet

What it does
GUAC aggregates software-security metadata into a queryable graph that connects artifacts, packages, dependencies and evidence.Read 15 Oct 2026 · guac.sh
Purpose
GUAC ingests software metadata such as SBOMs and maps relationships between software to provide supply chain security insights.Read 7 Oct 2026 · guac.sh
Deployment
The setup guide starts the GUAC server using Docker Compose and lists Docker, Docker Compose, and jq as prerequisites.Read 7 Oct 2026 · docs.guac.sh
API and visualization
GUAC provides APIs and a visualization tool for querying and exploring software supply chain data.Read 7 Oct 2026 · guac.sh
API stability
The documented GraphQL definitions are explicitly described as unstable and subject to future code changes.Read 15 Oct 2026 · docs.guac.sh
Available binaries
The install guide links GUAC CLI binaries for Linux x86_64, macOS ARM64, and Windows x86_64.Read 7 Oct 2026 · docs.guac.sh
Backends
Supported complete optimized backends are an in-memory keyvalue backend and an Ent backend using PostgreSQL.Read 15 Oct 2026 · github.com
Code license
The public GitHub repository identifies the project code as Apache-2.0 licensed.Read 15 Oct 2026 · github.com
Collection
GUAC collectors can read or watch files, storage buckets, and Git repositories; the filesystem collector is listed as stable while other collectors are experimental.Read 7 Oct 2026 · docs.guac.sh
Configuration
Settings can be supplied by command-line flags, GUAC_ environment variables or guac.yaml, in descending precedence.Read 15 Oct 2026 · docs.guac.sh
Documentation depth
Official documentation includes installation, demos, ingestion, PostgreSQL deployment, visualizer setup, configuration, APIs, ontology and observability.Read 15 Oct 2026 · docs.guac.sh
Documentation license
The documentation site states that its content is available under CC BY 4.0.Read 15 Oct 2026 · docs.guac.sh
Enrichment integrations
Stable enrichment sources include OSV for vulnerabilities, ClearlyDefined for licenses and Deps.dev for dependency information.Read 15 Oct 2026 · docs.guac.sh
Filesystem collector
The filesystem collector is marked stable, while other collectors are experimental and may change behavior.Read 15 Oct 2026 · docs.guac.sh
GraphQL API
GUAC exposes a GraphQL API for querying and mutating its software-supply-chain ontology.Read 15 Oct 2026 · docs.guac.sh
GraphQL filtering
An experimental filter directive supports case-insensitive CONTAINS and STARTSWITH comparisons.Read 15 Oct 2026 · docs.guac.sh
GUAC 1.0
OpenSSF announced GUAC 1.0 on June 12, 2025; the project reported more than 400 contributors from over 90 organizations.Read 15 Oct 2026 · openssf.org
Independent assessment: early maturity
SDxCentral described GUAC as beta software intended for experimentation and security-posture investigation at the time of its 2024 coverage.Read 15 Oct 2026 · sdxcentral.com
Independent assessment: portfolio scope
Ry Walker describes GUAC as a cross-cutting graph across SBOMs, attestations, scorecards, VEX and vulnerability data rather than a per-project SBOM manager.Read 15 Oct 2026 · rywalker.com
Independent assessment: roadmap gap
That SDxCentral coverage said prioritized built-in dashboards were still on the roadmap rather than established functionality.Read 15 Oct 2026 · sdxcentral.com
Independent technical origin
Kusari describes GUAC as a knowledge graph that correlates SBOMs, SLSA attestations and CVEs to support policy and incident decisions.Read 15 Oct 2026 · kusari.dev
Installable operating systems
Release binaries are documented for Linux x86_64, macOS and Windows x86_64.Read 15 Oct 2026 · docs.guac.sh
Installation prerequisites
The documented installation prerequisites are Docker, Docker Compose and jq.Read 15 Oct 2026 · docs.guac.sh
Latest listed release
The official release index lists GUAC v1.1.0 released on March 13, 2026.Read 15 Oct 2026 · guac.sh
Licensing
The GUAC documentation states that code is under the MIT license and documentation content is under CC BY 4.0.Read 7 Oct 2026 · docs.guac.sh
Limit: immature collectors
Independent analysis notes that only the filesystem collector is stable and other collection sources remain experimental.Read 15 Oct 2026 · rywalker.com
Limit: ingestion defects
Red Hat documents a known OSV collector failure when data does not conform to the GUAC GraphQL schema, with no workaround listed.Read 15 Oct 2026 · docs.redhat.com
Limit: large SBOM handling
Red Hat records that a 50,000-package SBOM previously failed to load until a later fix addressed token expiry during upload.Read 15 Oct 2026 · docs.redhat.com
Limit: operational burden
Independent analysis cautions that persistent deployments require operators to run PostgreSQL and feed the graph with evidence.Read 15 Oct 2026 · rywalker.com
Messaging integration
Collectors and certifiers communicate with the ingestor through NATS or the gocloud.dev SDK.Read 15 Oct 2026 · docs.guac.sh
OpenSSF status
GUAC joined the OpenSSF as an incubating project in March 2024.Read 15 Oct 2026 · sdxcentral.com
Origin
Google reported that GUAC was created with Kusari, Purdue University and Citi in October 2022 as a free open-source tool.Read 15 Oct 2026 · security.googleblog.com
Pipeline components
The architecture separates collectors, ingestors, assemblers and the CollectSub subscription service.Read 15 Oct 2026 · docs.guac.sh
Portfolio view
GUAC aggregates and makes queryable data across a software supply chain rather than limiting analysis to one SBOM at a time.Read 7 Oct 2026 · guac.sh
Praise: cross-project visibility
Independent coverage highlights GUAC's ability to correlate component data across large portfolios where individual SBOMs provide limited cross-project visibility.Read 15 Oct 2026 · buildstackreview.com
Project affiliation
GUAC is identified as an OpenSSF Incubating Project in the Supply Chain Integrity Working Group.Read 7 Oct 2026 · guac.sh
REST API
A REST API supplements GraphQL with endpoints including health checks and dependency-analysis queries.Read 15 Oct 2026 · docs.guac.sh
SBOM formats
GUAC documentation lists SPDX and CycloneDX as supported SBOM formats.Read 7 Oct 2026 · docs.guac.sh
SBOM ingestion
GUAC ingests SBOMs and maps relationships between software components.Read 15 Oct 2026 · docs.guac.sh
Security configuration
The configuration guide says gql-debug should be false in production for security.Read 15 Oct 2026 · docs.guac.sh
Self-hosting
GUAC is deployed locally or in user-controlled infrastructure with Docker Compose and optional PostgreSQL persistence.Read 15 Oct 2026 · docs.guac.sh
Stable data enrichment
The documentation lists OSV for vulnerability data, ClearlyDefined for license information, and Deps.dev for dependency information as stable graph enrichment sources.Read 7 Oct 2026 · docs.guac.sh
Storage
The GraphQL server supports an in-memory backend and a PostgreSQL backend for persistent storage.Read 7 Oct 2026 · docs.guac.sh
Storage integrations
Supported blob-storage sources include Azure, Google Cloud Storage, Amazon S3, Memblob and local filesystems.Read 15 Oct 2026 · docs.guac.sh
Supply-chain purpose
The project is intended to provide actionable insight into software-supply-chain security posture.Read 15 Oct 2026 · guac.sh
Supported formats
Stable ingestion formats include CSAF, OpenVEX, CycloneDX, DSSE, in-toto ITE6, SPDX and OpenSSF Scorecard.Read 15 Oct 2026 · docs.guac.sh
Target users
GUAC is described for developers, operations and security practitioners, and Open Source Program Offices.Read 7 Oct 2026 · guac.sh
Trustify merger
On August 25, 2025, Trustify joined the GUAC umbrella under a new steering committee.Read 15 Oct 2026 · guac.sh
Unsupported backends
ArangoDB and Neo4j/openCypher backends are classified as unsupported and incomplete; Redis and TiKV keyvalue variants are experimental.Read 15 Oct 2026 · github.com
Use cases
Listed use cases include finding vulnerable, deprecated, unsupported, or duplicated dependencies and identifying risky upstreams using OpenSSF Scorecard.Read 7 Oct 2026 · guac.sh
Visualization
The documentation provides a GUAC Visualizer setup and links from CLI results to visualizer views.Read 15 Oct 2026 · docs.guac.sh

Plans and prices

GUAC (open-source project) Free Code under MIT license · setup requires Docker, Docker Compose, and jq Read 7 Oct 2026 · docs.guac.sh
Open-source GUAC Free Apache-2.0 licensed · self-hosted · Docker, Docker Compose and jq required Read 15 Oct 2026 · rywalker.com

Every GUAC plan and price →

Strong points and limits

Strong points

  • Queries supply-chain data across a software portfolio
  • Supports SPDX and CycloneDX SBOMs
  • Enrichment sources include OSV, ClearlyDefined, and Deps.dev
  • GraphQL storage can use PostgreSQL
  • Free and open source

Limits

  • Setup requires Docker, Docker Compose, and jq
  • Only the filesystem collector is listed as stable
  • Other collectors are experimental

Who it suits

GUAC suits development, operations, and security practitioners, as well as Open Source Program Offices that need to query dependency relationships across a software portfolio. Setup requires familiarity with Docker, Docker Compose, and jq.

Verdict

GUAC is a free option for connecting software metadata and investigating dependency risks across a portfolio. Its documented setup prerequisites and experimental status for most collectors are important considerations.

Where Specifiction places it

Alternatives to GUACAll alternatives →