Skip to content
SPECIFICTION
Get listed

OWASP dep-scan

owasp.github.io

Free plan WindowsmacOSLinuxAPISelf-hosted
Visit owasp.github.io
Spec score 7.8 #33 of 65 in Software Composition Analysis Software

Spec sheet

Purpose
Audits project dependencies, container images, and operating systems for known vulnerabilities, advisories, and license limitations.Read 7 Oct 2026 · owasp.github.io
Platforms
The repository lists standalone binaries for Linux, macOS, and Windows, and also documents container use.Read 7 Oct 2026 · github.com
Integrations
Uses CycloneDX cdxgen to create SBOMs and documents integration with ORAS CLI and CI environments.Read 7 Oct 2026 · owasp.org
Support
The project says developers can be reached through its Discord channel.Read 7 Oct 2026 · owasp.org
Inputs
Supports local repositories, Linux container images, Kubernetes manifests, and operating systems.Read 7 Oct 2026 · owasp.github.io
License and audience
The repository identifies the project as MIT licensed and describes it for dependency and container-image security and license audits.Read 7 Oct 2026 · github.com
Local scanning
Package vulnerability scanning runs locally, and the project says it does not require a server for that mode.Read 7 Oct 2026 · owasp.github.io
Notable limitation
The documented package risk audit mode currently supports npm and PyPI packages only.Read 7 Oct 2026 · owasp.github.io
Prioritization
Identifies known CVEs with prioritization to help users focus on findings that need attention.Read 7 Oct 2026 · github.com
Reachability
Provides reachability analysis across Java, JavaScript/TypeScript, Python, PHP, Rust, Go, and .NET.Read 7 Oct 2026 · github.com
Reports
Can generate SBOMs with Vulnerability Disclosure Report information and CSAF 2.0/2.1 VEX documents.Read 7 Oct 2026 · github.com
Server and API
Can run as a self-hosted server with a /scan endpoint for scanning directories, SBOM files, and GitHub repositories.Read 7 Oct 2026 · github.com
Server security
The server refuses non-local binding unless an API key is configured or unauthenticated binding is explicitly enabled.Read 7 Oct 2026 · github.com
Vulnerability data
Lists OSV, NVD, GitHub, NPM, and Linux vulnerability data among its sources.Read 7 Oct 2026 · owasp.github.io

Plans and prices

OWASP dep-scan Free Free, open-source tool Fully open source · server mode and some extensions require the all package Read 7 Oct 2026 · owasp.org

Every OWASP dep-scan plan and price →

Where Specifiction places it

Alternatives to OWASP dep-scanAll alternatives →