Open-source alternatives to Osv Scanner

OpenSCA-cli is an open-source software composition analysis tool and vulnerability management command-line interface that inspects third-party dependencies for known security vulnerabilities and compliance risks. It parses package manager configuration and lock files across diverse programming languages to extract software component trees and generate standard inventory reports. The tool performs local vulnerability matching against embedded or downloaded databases without requiring external network connections, ensuring complete data privacy. It includes a license compliance engine that eval

Checkov is a static analysis tool and security scanner designed to identify misconfigurations in infrastructure as code, container images, and Kubernetes configurations. It functions as a cloud security posture tool, an SCA vulnerability scanner, and a secret scanning utility to prevent security breaches and version control leaks. The project distinguishes itself through deep graph analysis and variable resolution, allowing it to map relationships between interconnected resources and evaluate the final state of infrastructure attributes. It provides extensibility for defining custom security

This project is a command line interface for managing, installing, and publishing JavaScript packages to a remote registry. It serves as a dependency resolution tool, a software registry publishing client, and a security auditor for Node.js development workflows. The tool distinguishes itself by providing integrated monorepo workspace management and a comprehensive registry authentication client that supports multi-factor authentication. It enables detailed control over the software supply chain through provenance attestations, package signature verification, and the generation of a Software

Dependency-Track is a software composition analysis tool and vulnerability management system designed to track dependencies and supply chain risk. It functions as a platform for ingesting and analyzing CycloneDX software bills of materials to identify known vulnerabilities and license compliance issues within third-party software components. The system distinguishes itself by mirroring external vulnerability databases locally to enable fast offline analysis and using VEX documents to differentiate between technical vulnerabilities and actual contextual risks. It also integrates with identity

dependabot-core is the automated dependency management engine that powers multi-ecosystem package updates and vulnerability remediation. It parses package manifests and lockfiles, polls package registries for newer versions, resolves version constraints across entire dependency trees, and generates pull requests with changelogs and structured descriptions. The system integrates vulnerability database matching to detect known security flaws and can automatically create remediation pull requests. What distinguishes this project is its handling of complex multi-ecosystem resolution across dozens

Vuls is an agentless vulnerability scanner and CVE intelligence aggregator. It identifies security flaws in operating systems, containers, and network devices without requiring the installation of permanent software agents on target machines. The project distinguishes itself by cross-referencing software versions against multiple vulnerability databases, security advisories, and known exploit catalogs. It utilizes platform-based enumeration and lockfile analysis to detect vulnerabilities in network hardware, programming libraries, and website plugins. The tool covers a broad range of securit

Kubescape is a Kubernetes security posture management platform designed to scan clusters, manifests, and images for misconfigurations, vulnerabilities, and compliance risks. It functions as a comprehensive security suite incorporating a compliance scanner, a container image vulnerability scanner, an admission controller for policy enforcement, and a runtime security monitor. The platform distinguishes itself through runtime-aware vulnerability filtering, which maps libraries loaded in memory to determine if vulnerabilities are actually reachable. It also integrates with AI assistants via a Mo

Overcommit is a Git hook manager and pre-commit validation framework designed to automate the execution of scripts and checks during various Git events. It serves as a workflow automation tool that ensures code quality and project standards are met before changes are committed or pushed to a remote repository. The system distinguishes itself through a comprehensive YAML-based configuration that allows for detailed hook behavior control, including file execution filtering, conditional skipping, and the management of hook dependencies. It provides specialized roles such as a commit message vali

SecurityAdvisories is a software composition analysis tool and PHP security advisory database used to audit project dependencies against known security flaws and CVEs. It functions as a vulnerability scanner for PHP projects to identify and manage risky third-party libraries. The project implements a system for detecting and blocking vulnerable dependencies during the software development lifecycle. It prevents the installation of software packages with known security flaws by maintaining an exclusion list of forbidden versions. The tool integrates with the PHP package manager to intercept d

OSV is a distributed database and aggregator of open-source security advisories that uses a standardized vulnerability schema to track security flaws. It functions as a system for collecting and normalizing security data from diverse ecosystems into a single unified format, providing a web API for querying package vulnerabilities and submitting standardized records. The project distinguishes itself through a security advisory distribution service that supports bulk dataset exports via cloud storage buckets and incremental synchronization of security record updates. It also employs sandbox-bas

Grype is a command-line security scanner designed to identify known vulnerabilities within container images, filesystems, and software manifests. It functions as a software composition analysis tool that detects security flaws in application components and open-source libraries to support supply chain security. The tool distinguishes itself by reconstructing the final state of container images through layered filesystem inspection and normalizing diverse package formats into a unified dependency graph. It maintains a local cache of security advisories synchronized from multiple upstream sourc

Pipenv is a Python dependency manager and virtual environment manager that ensures reproducible environments across different systems. It functions as a lockfile resolver, generating deterministic lockfiles from high-level dependency constraints to prevent version drift. The tool integrates project workflow automation by loading environment variables and executing custom project scripts. It also includes security auditing capabilities to scan installed packages for known vulnerabilities. The system covers a broad range of capabilities including dependency version locking, package installatio

This project is a suite of automated tools and an LLM code review framework designed for design auditing, security scanning, and AI-driven code analysis. It functions as a developer workflow orchestrator that uses static analysis agents and agent-based workflows to automate pull request analysis and security audits. The system employs a dual-loop agent architecture to coordinate primary analysis and secondary verification, reducing false positives. It distinguishes itself through the use of browser automation to perform live UI component testing and verify frontend changes against accessibili

AboutLibraries is an open-source license compliance tool designed to collect, validate, and display third-party library licenses within software projects. It functions as a system for gathering dependency metadata at compile time and validating those libraries against a list of approved licenses to ensure legal compliance. The project provides a license validation engine that can enforce compliance by halting the build process when unauthorized licenses are detected. It also includes a set of visual components for rendering dependency and funding information within a user interface for third-

This project provides a comprehensive guide for securing the software supply chain within Node.js and npm environments. It focuses on hardening the entire lifecycle of third-party dependencies and package publishing processes to protect applications from malicious code injection and unauthorized registry modifications. The guide distinguishes itself by emphasizing identity-based authentication and cryptographic provenance to verify the origin of distributed artifacts. It advocates for strict governance policies, such as enforcing minimum release ages for dependencies and disabling automatic l

Trivy is a comprehensive security scanner designed to identify vulnerabilities and misconfigurations across container images, filesystems, and infrastructure as code files. It functions as a software composition analysis tool and an infrastructure security scanner, providing automated checks for CI/CD pipelines and cloud environments to ensure the integrity of the software supply chain. The tool distinguishes itself through a modular, plugin-based architecture that allows for the independent inspection of diverse targets. It utilizes a declarative policy engine to evaluate configurations agai

This project is a framework for the autonomous discovery and remediation of security vulnerabilities using large language model agents. It functions as a security research pipeline that automates the process of reconnaissance, crash discovery, and exploitability analysis to identify reproducible software bugs. The system distinguishes itself by utilizing a containerized agent sandbox that restricts network egress and filesystem access to prevent host compromise. It employs a specialized patch generation and validation loop, which includes adversarial re-attack testing where a fresh agent atte

The automated security helper is a command-line utility designed to orchestrate multiple security analysis tools into a unified, configuration-driven workflow. It functions as a central engine that executes static application security testing and infrastructure scans, aggregating diverse tool outputs into a standardized, machine-readable format to ensure consistent vulnerability detection across development lifecycles. The tool distinguishes itself through a modular plugin architecture that allows for the integration of custom or proprietary scanners, alongside an external intelligence layer

LastPass CLI is a command-line tool for managing secure credentials, authenticating user identities, and synchronizing encrypted password vaults directly from the terminal. It provides a terminal interface for storing, retrieving, and organizing sensitive account data with local encryption and remote synchronization, functioning as an encrypted vault management tool for handling credential storage across devices using remote authorization endpoints. The application communicates with remote servers over HTTPS while securing user credentials locally and in transit using client-side symmetric en

Terrascan is an infrastructure as code security scanner and cloud configuration auditor designed to detect security violations and compliance risks in cloud templates and Dockerfiles before provisioning. It utilizes the Open Policy Agent to evaluate infrastructure templates against both standard security policies and custom organizational rules. The project functions as a security guardrail within build pipelines, blocking risky deployments by integrating scanning logic directly into CI/CD workflows. It also includes a container registry vulnerability scanner that collects vulnerability data

Zizmor is a security linter and static analysis tool designed to audit GitHub Actions workflow files. It functions as a CI/CD security scanner that identifies security vulnerabilities, misconfigurations, and software supply chain risks within automation pipelines. The project distinguishes itself by providing an automated workflow remediator that applies security fixes to identified vulnerabilities. It also implements a language server for integration with code editors and supports a variety of analysis personas to scale the sensitivity and volume of reported findings. The tool covers a broa

This project provides a comprehensive guide and set of architectural patterns for developing professional command-line interfaces using Node.js. It focuses on establishing industry standards for terminal-based applications, ensuring that tools are predictable, maintainable, and user-friendly. The guide emphasizes creating high-quality user experiences through interactive terminal elements, actionable error reporting, and graceful handling of system signals. It distinguishes itself by detailing how to integrate command-line tools into automated pipelines, specifically through the use of struct

This project is a dependency management tool for Go designed to track and lock package versions to ensure reproducible builds across different environments. It functions as a version lock file manager, recording complete snapshots of the dependency graph to prevent version drift, and as a semantic version constraint resolver that calculates compatible package versions. The tool orchestrates a local vendor directory, mirroring external source code to enable offline builds and source auditing. It utilizes a combination of static analysis to discover required libraries and a logic engine to inte

Nettacker is an automated penetration testing framework designed to orchestrate reconnaissance, port scanning, and vulnerability detection. It functions as a network reconnaissance tool and vulnerability scanner that identifies open ports, fingerprints services, and checks systems against databases of known security flaws. The framework distinguishes itself by combining a web application crawler for discovering hidden paths via fuzzing with a vulnerability management system that persists scan results in a database to track historical assessments. It also includes specialized capabilities for

Terrascan is a static analysis tool designed to evaluate infrastructure-as-code configuration files for security vulnerabilities and compliance violations. By parsing these files into an intermediate representation, it identifies risks before cloud resources are provisioned, serving as a compliance auditor for cloud-native environments. The tool functions as a policy-as-code engine, allowing users to define and enforce custom security rules and industry benchmarks using a specialized query language. It distinguishes itself through its ability to integrate directly into development and deploym

SkillSpector is a security scanner designed to detect vulnerabilities and malicious patterns in AI agent plugins and extensions before they are installed. It functions as a runtime guardrail that calculates numeric risk scores and assigns severity labels to provide installation recommendations or block risky external extensions. The project distinguishes itself by using language models to perform semantic code analysis, evaluating code intent and context to reduce false positives. It also employs fingerprint-based issue suppression to track and ignore previously accepted risks across repeated

CocoaPods is a dependency manager for Swift and Objective-C projects that integrates third-party libraries via configuration files. It serves as a project workspace orchestrator, coordinating the build process and linking external dependencies through centralized workspace configurations. To ensure environment consistency across different development machines, it employs a manifest-based version locking system. The project provides a version-controlled library specification registry for managing and distributing metadata and source paths for reusable code modules. It includes tools for extern