XmirrorSecurity/OpenSCA-cli
OpenSCA Cli
OpenSCA-cli is an open-source software composition analysis tool and vulnerability management command-line interface that inspects third-party dependencies for known security vulnerabilities and compliance risks. It parses package manager configuration and lock files across diverse programming languages to extract software component trees and generate standard inventory reports.
The tool performs local vulnerability matching against embedded or downloaded databases without requiring external network connections, ensuring complete data privacy. It includes a license compliance engine that evaluates dependency licenses against predefined rule sets to detect usage restrictions and policy violations, alongside remote directory scanning capabilities.
Execution paths and database parameters are managed through command-line arguments and configuration files. Scan results and component inventories can be exported into standard formats such as JSON, HTML, SARIF, and SBOM, while an optional cloud sync pipeline uploads local scan telemetry and compliance reports to a centralized management service using project tokens.
Features
- SBOM Generators - Generates software bill of materials inventories in standard formats like SPDX and HTML during project scans.
- Software Bill of Materials Generators - Produces standard inventory reports of all software components and dependencies used in a project build.
- Multi-Language Dependency Analysis - Parses package manager configuration and lock files across diverse programming languages to extract third-party software component trees.
- Project Directory Scanning - Traverses project directories and remote file systems to identify dependency manifests for security analysis.
- License Compliance Tools - Evaluates dependency licenses against predefined rule sets to detect usage restrictions and policy violations.
- Dependency Vulnerability Scanning - Parses configuration and lock files across multiple programming languages to detect open source dependencies and identify known vulnerabilities.
- Vulnerability Matching - Cross-references identified dependencies against embedded or downloaded vulnerability databases without requiring external network connections.
- Software Composition Analysis Tools - Scans third-party dependencies for known vulnerabilities and license compliance risks as a command-line security tool.
- Software Supply Chain Security - Scanning project dependencies and third-party components to detect known security vulnerabilities and compliance risks.
- Vulnerability Management - Detects security flaws in open source packages and integrates with local or cloud databases via a command-line interface.
- Offline Vulnerability Analysis - Ensures complete data privacy during local scans by restricting communication with external platforms and using local databases.
- Scan Result Exporters - Exports security scan results to standard formats including JSON, HTML, SARIF, and SBOM specifications.
- Data Privacy Controls - Ensures complete data privacy during local scans by restricting communication with cloud platforms when using offline vulnerability databases.
- Vulnerability Database Management - Synchronizes and manages local copies of security vulnerability databases for offline analysis.
- Pluggable Reporting Architectures - Transforms raw scan results into standardized formats like JSON, SARIF, SBOM, and HTML through modular serialization writers.
