Skip to content
SPECIFICTION
Get listed

OpenSCA

opensca.xmirror.cn

Free plan WebWindowsmacOSLinuxSelf-hostedBrowser extension
Visit opensca.xmirror.cn
Spec score 8.0 #22 of 65 in Software Composition Analysis Software

What it is

OpenSCA analyzes software components and dependencies for vulnerabilities and open-source license risks. It can be used through an IDE, command line or cloud platform, with online and offline use described. The CLI is available for Windows, Linux and macOS, and documented package ecosystems cover Java, JavaScript, PHP, Ruby, Go, Rust, Erlang and Python. OpenSCA generates SBOMs in DSDX, SPDX, CycloneDX and SWID formats; it can also take an SBOM as input to create a vulnerability report or convert formats. CLI report formats include JSON, XML, HTML, SQLite, CSV and SARIF. Its cloud vulnerability database covers CVE, CWE, NVD, CNVD and CNNVD, and configurable local databases and private package repositories are supported. Xcheck plugins are documented for IntelliJ IDEA and VS Code, and pull request scanning is supported. The free plan costs nothing. Parsing requirements.txt and requirements.in requires a pipenv environment and an internet connection.

Spec sheet

Purpose
OpenSCA analyzes software components and dependencies to identify vulnerabilities and open-source license risks.Read 5 Oct 2026 · opensca.xmirror.cn
Intended users
The maker describes the solution as serving enterprises, organizations, and individual users.Read 5 Oct 2026 · opensca.xmirror.cn
Support
The project invites issues and lists [email protected] and QQ group 832039395 for contact.Read 5 Oct 2026 · github.com
License
The OpenSCA-cli repository identifies its license as Apache-2.0.Read 5 Oct 2026 · github.com
Founded
2014Read 28 Sep 2026 · opensca.xmirror.cn
Custom databases
The product documentation says users can configure vulnerability databases and private package repositories.Read 5 Oct 2026 · opensca.xmirror.cn
IDE integrations
The documentation provides OpenSCA Xcheck plugins for IntelliJ IDEA and VS Code.Read 5 Oct 2026 · opensca.xmirror.cn
Interfaces
The maker describes use through an IDE, command line, or cloud platform, with online and offline scenarios.Read 5 Oct 2026 · opensca.xmirror.cn
Language coverage
The documented package ecosystems include Maven and Gradle for Java, npm, Composer, Ruby gems, Go modules, pip, Cargo, and Rebar.Read 5 Oct 2026 · opensca.xmirror.cn
Operating systems
The CLI is available for Windows, Linux, and macOS.Read 5 Oct 2026 · github.com
Report formats
The CLI supports JSON, XML, HTML, SQLite, CSV, and SARIF reports, alongside several SBOM formats.Read 5 Oct 2026 · github.com
SBOM
It generates SBOMs in DSDX, SPDX, CycloneDX, and SWID formats, and can take an SBOM as input to produce a vulnerability report or convert it to another format.Read 5 Oct 2026 · opensca.xmirror.cn
Scan-time factors
The maker says scanning time depends on package size, network conditions, and programming language.Read 5 Oct 2026 · github.com
Scanning limitation
Parsing requirements.txt and requirements.in requires a pipenv environment and an internet connection, according to the language support page.Read 5 Oct 2026 · opensca.xmirror.cn
Vulnerability data
The CLI documentation says its cloud vulnerability database covers CVE, CWE, NVD, CNVD, and CNNVD, and it also supports a configurable local vulnerability database.Read 5 Oct 2026 · github.com

Plans and prices

OpenSCA Free Online and offline use stated; no other plan limits stated Read 5 Oct 2026 · opensca.xmirror.cn

Every OpenSCA plan and price →

Strong points and limits

Strong points

  • Free plan at free
  • CLI available on Windows, Linux and macOS
  • Generates and accepts multiple SBOM formats
  • Supports configurable local vulnerability databases
  • IDE plugins and pull request scanning

Limits

  • Two Python requirements files need pipenv
  • Parsing those files also needs internet access
  • Scan time depends on package size, network and language

Who it suits

OpenSCA is intended for enterprises, organizations and individual users that need to review component vulnerabilities or open-source license risks. It suits teams that work with the documented package ecosystems and SBOM formats.

Verdict

OpenSCA offers several ways to scan, broad documented ecosystem coverage and configurable vulnerability data. Check the pipenv and internet requirements if parsing requirements.txt or requirements.in is part of your workflow.

Where Specifiction places it

Alternatives to OpenSCAAll alternatives →