OSI-licensed open source

Open-Source SCA and SBOM Tools (2026)

Software composition analysis (SCA) finds the open-source components in your code and images and matches them against known vulnerabilities and licences. An SBOM (software bill of materials) is the inventory itself, usually in CycloneDX or SPDX format, which SCA tools generate and consume.

This page is for developers and security teams who want free tooling in CI. It pairs SBOM generators (Syft, cdxgen), scanners (Grype, Trivy, OSV-Scanner, Dependency-Check), a portfolio platform (Dependency-Track) and a licence scanner (ScanCode). All are Apache-2.0 licensed as read from their repositories.

Tools, licences and pricing checked against vendor and repository pages on November 7, 2026.

What to look for

  • •Ecosystem coverage: languages, containers, filesystems
  • •SBOM formats supported (CycloneDX, SPDX)
  • •Vulnerability data sources and update cadence
  • •CI integration and speed
  • •Licence detection versus vulnerability scanning
  • •Continuous monitoring of stored SBOMs

At a glance

ToolBest forPricingLicence
SyftGenerating SBOMsFree, open sourceApache-2.0
GrypeFast vulnerability matchingFree, open sourceApache-2.0
TrivyAll-in-one scanner in CIFree, open sourceApache-2.0
OWASP Dependency-CheckJava and build-tool-integrated SCAFree, open sourceApache-2.0
OWASP Dependency-TrackContinuous SBOM portfolio monitoringFree, open sourceApache-2.0
OSV-ScannerLockfile scanning in CIFree, open sourceApache-2.0
CycloneDX cdxgenCycloneDX SBOM generationFree, open sourceApache-2.0
ScanCode ToolkitLicence complianceFree, open sourceApache-2.0

1. Syft

Apache-2.0

Best for: Generating SBOMs · Free, open source

CLI and library for generating an SBOM from container images and filesystems, with support for SPDX and CycloneDX output.

Strengths

  • + Wide ecosystem coverage
  • + Pairs with Grype

Trade-offs

  • − Generates inventories only; scanning needs another tool
WebsiteRepository

2. Grype

Apache-2.0

Best for: Fast vulnerability matching · Free, open source

Vulnerability scanner for container images and filesystems that can scan SBOMs produced by Syft.

Strengths

  • + Works from SBOMs
  • + Easy CI use

Trade-offs

  • − Vulnerability scanning only
WebsiteRepository

3. Trivy

Apache-2.0

Best for: All-in-one scanner in CI · Free, open source

Scanner from Aqua Security for vulnerabilities, misconfigurations, secrets and licences across images, repositories and clusters, with SBOM support.

Strengths

  • + Broad coverage in one binary
  • + Large community

Trade-offs

  • − Broad scope means more tuning of results
WebsiteRepository

4. OWASP Dependency-Check

Apache-2.0

Best for: Java and build-tool-integrated SCA · Free, open source

OWASP software composition analysis tool that detects publicly disclosed vulnerabilities in a project's dependencies.

Strengths

  • + Maven and Gradle plugins
  • + Long-standing OWASP project

Trade-offs

  • − Identification can produce false positives
WebsiteRepository

5. OWASP Dependency-Track

Apache-2.0

Best for: Continuous SBOM portfolio monitoring · Free, open source

Component analysis platform that ingests SBOMs and continuously monitors portfolio risk from vulnerable and outdated components.

Strengths

  • + Continuous monitoring
  • + CycloneDX native

Trade-offs

  • − Needs a server to run
WebsiteRepository

6. OSV-Scanner

Apache-2.0

Best for: Lockfile scanning in CI · Free, open source

Google's scanner that checks dependencies and lockfiles against the OSV vulnerability database.

Strengths

  • + Uses the open OSV database
  • + Simple CLI

Trade-offs

  • − Focused on vulnerabilities
WebsiteRepository

7. CycloneDX cdxgen

Apache-2.0

Best for: CycloneDX SBOM generation · Free, open source

CLI that generates CycloneDX SBOMs for many languages and ecosystems.

Strengths

  • + Many ecosystems
  • + CycloneDX native

Trade-offs

  • − Generator only
WebsiteRepository

8. ScanCode Toolkit

Apache-2.0

Best for: Licence compliance · Free, open source

AboutCode tool that scans code to detect licenses, copyrights and package manifests.

Strengths

  • + Deep licence detection
  • + Useful for audits

Trade-offs

  • − Not a vulnerability scanner
WebsiteRepository

New tools in this space, weekly

One email a week with the tools, launches and releases added to TechLogHub. Unsubscribe in one click.

Get the TechLogHub digest

One email a week: new and trending developer tools, fresh comparisons, and what shipped. Unsubscribe in one click.

How to choose

If you need…Start with
Generate SBOMs from imagesSyft
All-in-one scanning in CITrivy
Scan from an SBOMGrype
Track SBOMs over timeDependency-Track
Java buildsOWASP Dependency-Check
Licence auditsScanCode Toolkit

Open-Source SCA and SBOM Tools: FAQ

Quick answers to common questions

What is the difference between SCA and an SBOM?

SCA analyzes components for vulnerabilities and licences; an SBOM is the inventory those tools use or produce.

Which SBOM formats exist?

CycloneDX and SPDX are the two common formats; Syft supports both.

Can I combine these tools?

Yes. A common pairing is Syft or cdxgen to generate, Grype or Trivy to scan, and Dependency-Track to monitor.

Do open-source SCA tools find licence problems?

ScanCode and Trivy cover licences; others focus on vulnerabilities.

Are they enough for compliance?

They provide data; processes and review are still needed.

Related categories

Best Open-Source Software Security ToolsOpen-Source Container Scanning ToolsVulnerability Management Software ComparedOpen-Source License Compliance Managers

Building a tool in this category?

List it on TechLogHub and we'll review it for this guide.

Submit a tool