OSS Review Toolkit

Spec sheet

Purpose

ORT is a FOSS policy automation toolkit for managing software dependencies.Read 4 Oct 2026 · oss-review-toolkit.org

Community support

The project links to a community Slack and provides the team contact [email protected].Read 4 Oct 2026 · oss-review-toolkit.org

Container image sizes

For release 13.0.0, the full Docker image is approximately 7 GB and the minimal image approximately 3 GB.Read 4 Oct 2026 · oss-review-toolkit.org

Installation

ORT is available as Docker images, a binary distribution from GitHub releases, or a build from source.Read 4 Oct 2026 · oss-review-toolkit.org

Package ecosystem coverage

The analyzer supports package managers including Gradle, Maven, NPM, PNPM, Yarn, Cargo, Composer, PIP, Poetry, and NuGet.Read 4 Oct 2026 · oss-review-toolkit.org

Pipeline tools

The toolkit includes tools to analyze dependencies, download source code, scan for license and copyright findings, retrieve security advisories, evaluate policies, report results, and send notifications.Read 4 Oct 2026 · oss-review-toolkit.org

Policy checks

Its risk-based policy-as-code checks cover licensing, security vulnerabilities, InnerSource, and engineering standards.Read 4 Oct 2026 · oss-review-toolkit.org

Report formats

Reporters can produce outputs including CycloneDX BOMs, SPDX documents, static HTML, Web App reports, and NOTICE files.Read 4 Oct 2026 · oss-review-toolkit.org

SBOMs and attribution

It can generate CycloneDX and SPDX SBOMs, as well as custom FOSS attribution documentation.Read 4 Oct 2026 · oss-review-toolkit.org

Security configuration caveat

The PIP analyzer can execute setup.py files to resolve dependencies when configured to do so, and the documentation flags this as a potential security risk.Read 4 Oct 2026 · oss-review-toolkit.org

Supported operating systems

The project says ORT is continuously used by its core development team on Linux, Windows, and macOS, which it considers well supported.Read 4 Oct 2026 · oss-review-toolkit.org

Usage and CI

ORT can be used as a library, through its command-line interface, or via CI integrations.Read 4 Oct 2026 · oss-review-toolkit.org

Vulnerability data integrations

The advisor can retrieve vulnerability information from configured providers including OSV, VulnerableCode, OSS Index, and Black Duck.Read 4 Oct 2026 · oss-review-toolkit.org

Plans and prices

Every OSS Review Toolkit plan and price →

Where Specifiction places it

• Dependency Management Software#16 of 277.7
• Software Composition Analysis Software#39 of 657.7
• Open Source License Compliance Software#18 of 287.6