GUAC vs Kusari

GUAC ingests software metadata, including software bills of materials, and connects it into a queryable view of supply-chain relationships. That portfolio-level view lets developers, operations and security practitioners, and Open Source Program Offices examine dependencies across software rather than one SBOM at a time. Teams can look for vulnerable, deprecated, unsupported, or duplicated dependencies and identify risky upstreams using OpenSSF Scorecard. APIs and a visualization tool support queries and exploration. GUAC documents SPDX and CycloneDX SBOM formats, with graph enrichment from OSV for vulnerability data, ClearlyDefined for license information, and Deps.dev for dependency information. Its GraphQL server can use in-memory storage or PostgreSQL for persistence. Collectors can read or watch files, storage buckets, and Git repositories; the filesystem collector is stable, while other collectors are experimental. Setup uses Docker Compose and requires Docker, Docker Compose, and jq. The project is an OpenSSF Incubating Project. GUAC is free and open source: its code is under the MIT license, and documentation content is under CC BY 4.0.

Kusari is a software supply chain security platform that maps components across repositories, images, and pipelines in an evolving knowledge graph called the Trust Fabric. It builds that graph from source and build artifacts and enriches each node. Its Kusari Score weighs technical severity alongside reachability, exploitability, blast radius, effort to fix, ownership, and license. The platform accepts source and build artifacts, CycloneDX and SPDX SBOMs, VEX, and existing scanner output. Inspector reviews pull requests through GitHub, GitLab, or the CLI, returning a merge decision and a fix. Its checks cover vulnerabilities, transitive dependencies, secrets, typosquatted packages, licensing, unmaintained components, code weaknesses, and pipeline or image configuration. Reviews can include up to 2,000 dependency changes, with up to 1,000 high-priority changes examined in depth. Kusari lists integrations including GitHub, Jenkins, Jira, ServiceNow, Slack, and Microsoft Teams. The free plan includes unlimited public repositories and one private repository; Starter Team is $50 a month, with a 30-day free period.