Skip to content
SPECIFICTION
Get listed

TRUSCA

github.com

Free plan WebLinuxAPISelf-hosted
Visit github.com
Spec score 7.3 #16 of 22 in SBOM Management Software

What it is

TRUSCA is a free, open-source, self-hosted software composition analysis platform for CVE tracking, license compliance, and SBOM management. It uses cdxgen to detect packages across more than 30 language ecosystems, while Trivy matches components with NVD, OSV, GitHub Advisory, EPSS, and KEV data. Weekly database refreshes add new CVEs. TRUSCA imports CycloneDX or SPDX SBOMs and exports CycloneDX in JSON or XML and SPDX in JSON or Tag-Value. CI integrations include GitHub Actions, GitLab CI, Jenkins examples, a REST API, and API keys; build gates can fail on Critical CVEs or forbidden licenses. License workflows classify licenses as allowed, conditional, or forbidden, generate NOTICE files, and block forbidden licenses. The platform also offers approvals, an append-only audit log, email, Slack, Teams notifications, VEX triage, and EPSS prioritization. It runs through Docker Compose or Helm. It does not analyze users’ own source code.

Spec sheet

Purpose
TRUSCA is a self-hosted software composition analysis platform for CVE tracking, license compliance, and SBOM management.Read 3 Oct 2026 · trustedoss.github.io
Intended users
The project describes the portal as serving engineering, legal, and security teams.Read 3 Oct 2026 · trustedoss.github.io
Deployment
TRUSCA is distributed for users to run themselves with Docker Compose or a Helm chart; a read-only live demo is also available.Read 3 Oct 2026 · trustedoss.github.io
Support
The project says it has no paid support tier or managed hosting and directs users to its community support channels.Read 3 Oct 2026 · github.com
CI integrations
The project documents a GitHub Action, GitLab CI template, Jenkinsfile example, REST API, and API keys; its build gate can fail on a Critical CVE or forbidden license.Read 3 Oct 2026 · trustedoss.github.io
Component detection
It uses cdxgen to detect packages across 30+ language ecosystems.Read 3 Oct 2026 · trustedoss.github.io
Language support
The UI, error messages, and documentation are available in English and Korean.Read 3 Oct 2026 · trustedoss.github.io
License workflow
Licenses are classified as allowed, conditional, or forbidden, with NOTICE file generation and build blocking for forbidden licenses.Read 3 Oct 2026 · trustedoss.github.io
Not a SAST scanner
The documentation says TRUSCA does not analyze users’ own source code and focuses on third-party components.Read 3 Oct 2026 · trustedoss.github.io
Notifications and audit
Workflow features include component approval, an append-only audit log, and notifications via email, Slack, and Teams.Read 3 Oct 2026 · trustedoss.github.io
SBOM
TRUSCA exports CycloneDX in JSON or XML and SPDX in JSON or Tag-Value, and can ingest CycloneDX or SPDX SBOMs.Read 3 Oct 2026 · trustedoss.github.io
Security triage
TRUSCA provides a seven-state CycloneDX VEX triage workflow and EPSS prioritization.Read 3 Oct 2026 · trustedoss.github.io
Vulnerability feeds
Trivy matches components against NVD, OSV, GitHub Advisory, EPSS, and KEV data, with new CVEs picked up on weekly database refreshes.Read 3 Oct 2026 · trustedoss.github.io

Plans and prices

Apache-2.0 self-hosted Free No per-seat licensing · self-hosted deployment Read 3 Oct 2026 · trustedoss.github.io

Every TRUSCA plan and price →

Strong points and limits

Strong points

  • Open source under Apache-2.0
  • Detects packages across 30+ ecosystems
  • Imports and exports CycloneDX and SPDX
  • CI build gates for CVEs and licenses
  • Email, Slack, and Teams notifications

Limits

  • Self-hosted deployment required
  • No managed hosting
  • No paid support tier
  • Does not analyze your own source code

Who it suits

It suits engineering, legal, and security teams managing third-party components and SBOM exchange. Teams must operate their own deployment because managed hosting and paid support are unavailable.

Verdict

TRUSCA covers vulnerability feeds, license policy, SBOM formats, CI gates, and security workflow controls in a self-hosted package. Its focus is third-party components, not SAST analysis.

Where Specifiction places it

Alternatives to TRUSCAAll alternatives →