Skip to content
SPECIFICTION
Get listed

ts-scan

trustsource.io

WindowsmacOSLinuxAPISelf-hosted
Visit trustsource.io
Spec score 7.3 #49 of 65 in Software Composition Analysis Software

Spec sheet

Purpose
ts-scan scans software dependencies and generates a software bill of materials (SBOM).Read 9 Oct 2026 · trustsource.io
Intended users
The maker describes ts-scan as an open-source CLI scanner for use in CI/CD pipelines to identify dependencies and create SBOMs.Read 9 Oct 2026 · trustsource.io
API
The product page says results can flow through a documented REST API to TrustSource or other tooling.Read 9 Oct 2026 · trustsource.io
License
The repository identifies ts-scan as Python software under the Apache-2.0 license.Read 9 Oct 2026 · github.com
Headquarters
Frankfurt am Main, GermanyRead 28 Sep 2026 · trustsource.io
Company
TrustSource identifies itself as a brand of EACG GmbH.Read 9 Oct 2026 · trustsource.io
Maker
TrustSource is a brand of EACG GmbH; the site operator is EACG Operations Services GmbH, located in Frankfurt am Main, Germany.Read 9 Oct 2026 · trustsource.io
Analysis
It analyzes native lockfiles and build configurations to identify dependencies without additional configuration.Read 9 Oct 2026 · trustsource.io
Backend
Scan results can be sent through a documented REST API to the TrustSource platform or other tooling.Read 9 Oct 2026 · trustsource.io
CI integration
The product page says ts-scan integrates with GitHub workflows through a GitHub Action.Read 9 Oct 2026 · trustsource.io
CI/CD integration
The maker says ts-scan integrates into GitHub workflows as a GitHub Action.Read 9 Oct 2026 · trustsource.io
Community support
The documentation directs community users to file repository tickets and says TrustSource subscribers can contact TrustSource support.Read 9 Oct 2026 · trustsource.github.io
Dependency analysis
ts-scan analyzes native lockfiles and build configurations to find direct and transitive dependencies.Read 9 Oct 2026 · trustsource.io
Dependency coverage
The product page says ts-scan supports more than 20 build systems, including Maven, Gradle, npm, PyPI, NuGet, Composer, Go Modules, Cargo and CocoaPods.Read 9 Oct 2026 · trustsource.io
Installation
The maker documents installation with pip and says Docker images and source builds are available in the repository.Read 9 Oct 2026 · trustsource.io
Open source
The scanner is open source and its GitHub repository identifies the license as Apache-2.0.Read 9 Oct 2026 · github.com
Other CI integrations
TrustSource says ts-scan integrates with GitHub Actions, GitLab CI and Jenkins.Read 9 Oct 2026 · trustsource.io
SBOM formats
It exports SBOMs in SPDX and CycloneDX formats.Read 9 Oct 2026 · trustsource.io
Security and policy checks
Uploaded SBOMs can be checked on the TrustSource platform against vulnerability databases, license policies and regulatory requirements.Read 9 Oct 2026 · trustsource.io
Security behavior
The maker says that from version 1.5.2, ts-scan no longer executes package.json lifecycle scripts by default and instead warns about the configuration.Read 9 Oct 2026 · trustsource.io
Supported build systems
The product page lists support for more than 20 build systems, including Maven, Gradle, npm, PyPI, NuGet, Composer, Go Modules, Cargo, and CocoaPods.Read 9 Oct 2026 · trustsource.io
Supported ecosystems
The maker's SCA page lists ecosystems and package managers including C, C++, C#, Rust, Go, Python, Java, JavaScript, TypeScript, Swift, Maven, NuGet, Gradle, npm, Composer, Cargo and Docker.Read 9 Oct 2026 · trustsource.io
Target audience
The maker describes ts-scan as an open-source scanner for automating software composition analysis in CI/CD pipelines.Read 9 Oct 2026 · trustsource.io

Where Specifiction places it

Alternatives to ts-scanAll alternatives →