Mend SCA vs Retire.js
Mend SCA
mend.ioRetire.js
retirejs.github.ioSide by side
| Figure | Mend SCA | Retire.js |
|---|---|---|
| Price from | $20.83/mo | Free |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 3 | 1 |
| Spec score · Software Composition Analysis Software | 8.6 (#6) | 8.2 (#14) |
| Funding | Startup Nation Central reports $121 million in cumulative funding across five rounds and 201–500 employees. | The project says donations fund maintenance of the tool and vulnerability repository. |
| Integrations | The integrations page lists GitHub, GitLab, Bitbucket, Azure DevOps, Jira, ServiceNow, Jenkins, Docker, JFrog Artifactory and several IDEs. | Retire.js has a Burp plugin and an OWASP ZAP add-on; ZAP officially supports its add-on and includes it in weekly releases. |
| Purpose | Mend SCA identifies, prioritizes and remediates security and license risks in applications’ open source components. | Retire.js detects JavaScript library versions with known vulnerabilities, including libraries that are not listed in package manifests. |
| SBOM | Mend exports SPDX and CycloneDX SBOMs, imports third-party SBOMs and uses VEX data. | Retire.js can generate CycloneDX SBOMs in XML and JSON, including newer JSON formats with vulnerability sections. |
Plans
Mend SCA
- Mend Renovate Enterprise$250 a year
- Mend AI$300 a year
- Mend AppSec$1,000 a year
In their own words
Retire.js
Retire.js detects JavaScript library versions with known vulnerabilities, including libraries stored directly in source control. Its command-line scanner checks web apps and Node.js projects for vulnerable libraries and Node.js modules, and requires Node.js and npm to install and run. By default, the CLI exits with code 13 when it finds vulnerabilities; its behavior can be changed with `--exitwith 0`. Chrome and Firefox extensions scan visited sites and report insecure libraries in the developer console and browser toolbar. The Chrome extension is not officially available in the Chrome Web Store, and the Firefox extension is deprecated. Retire.js also has a Burp extension and an OWASP ZAP add-on, while retire-site-scanner supports headless website scanning. It can generate CycloneDX SBOM output, including JSON formats and versions with a vulnerabilities section. The Grunt plugin and Gulp task are also marked deprecated. Retire.js is free and is distributed under Apache License 2.0.