The main free alternatives to commercial SCA scanners are OSV-Scanner, Grype, Trivy and OWASP Dependency-Check. All four are open source and run from a command line or CI job. They differ in vulnerability data source, input types and extra scanners, so the right pick depends on what you ship.
Safeguard publishes this guide and sells a competing product, so we describe other tools only from their own documentation. Facts below are as of 19 October 2026.
Key takeaways
- OSV-Scanner reads lockfiles and manifests and matches them against the OSV.dev database.
- Grype scans container images, filesystems and SBOMs and ranks results using EPSS and KEV data.
- Trivy covers vulnerabilities plus misconfiguration, secrets and license scanning in one tool.
- OWASP Dependency-Check matches dependencies to CPE identifiers and uses NVD data feeds.
- Free scanners give you findings. Triage, policy and reporting are work you do yourself.
What are the best free alternatives to a commercial SCA scanner?
Four tools come up most often: OSV-Scanner, Grype, Trivy and OWASP Dependency-Check. Each is documented publicly, so you can check the claims here against the source.
Software composition analysis (SCA) means listing the open source packages in your software and checking them against known vulnerabilities. A free scanner does that job. What a commercial product adds is usually around the scan, such as dashboards, policy gates, ticketing and support. We list the pages we read under Sources.
How does each free scanner work?
Each tool builds a package list from your project and matches it against a vulnerability source. The sources differ, and that changes what you see in results.
OSV-Scanner. Its docs describe it as an officially supported frontend to the OSV.dev database. It runs as a CLI in a terminal or CI/CD pipeline and also works as a Go library. Its source scan supports lockfiles and manifests for many ecosystems, including package-lock.json, pnpm-lock.yaml, yarn.lock, go.mod, pom.xml, Cargo.lock, composer.lock, poetry.lock and Gemfile.lock. It can also scan container images for artifacts such as Alpine APK packages, Debian and Ubuntu packages, Go binaries and Node modules.
Grype. The README calls it a vulnerability scanner for container images and filesystems. It also accepts SBOMs as input. It covers OS packages for distributions such as Alpine, Debian, Ubuntu and RHEL, plus language ecosystems including Ruby, Java, JavaScript, Python, .NET, Go, PHP and Rust. It uses EPSS, KEV and risk scoring to help rank threats, and supports OpenVEX for filtering results. The license is Apache-2.0.
Trivy. Trivy is an open source scanner from Aqua Security under Apache-2.0. Its targets include container images, filesystems, remote Git repositories, virtual machine images and Kubernetes. Its scanners cover vulnerabilities, misconfiguration, secrets and licenses.
OWASP Dependency-Check. Its project page describes analyzers that collect evidence about each dependency, use that evidence to identify a CPE, and then list the matching CVE entries in a report. Vulnerability data comes from the NVD data feeds hosted by NIST. It ships as a command line tool, Maven plugin, Gradle plugin and Ant task, with integrations for Jenkins, GitHub Actions and Azure DevOps. The license is Apache 2.0.
Comparison table
| Criteria | OSV-Scanner | Grype | Trivy | OWASP Dependency-Check |
|---|---|---|---|---|
| Main input | Lockfiles, manifests, container images | Container images, filesystems, SBOMs | Images, filesystems, repos, VM images, Kubernetes, SBOMs | Project dependencies |
| Vulnerability data | OSV.dev database | Not detailed on the page we read | Not detailed on the page we read | NVD feeds, plus sources such as NPM Audit API and OSS Index for some technologies |
| Beyond vulnerabilities | Not stated | EPSS, KEV, OpenVEX filtering | Misconfiguration, secrets, licenses | Not stated |
| Interfaces | CLI, Go library, GitHub Action | CLI | CLI, standalone and client/server modes | CLI, Maven, Gradle, Ant, CI plugins |
| License | Not stated on the page we read | Apache-2.0 | Apache-2.0 | Apache 2.0 |
When does a free scanner fall short of a commercial one?
A free scanner stops at findings, and the surrounding workflow is yours to build. We do not claim any specific product is better here. We can only describe what the free tools document.
Things to check against your own needs:
- A central place to view findings across many repositories.
- Policy rules that block a pull request.
- Ownership, due dates and ticket creation.
- Reporting for auditors and customers.
- Whether the scanner tells you if a vulnerable function is actually called.
Dependency-Check's docs note that after the first download of NVD data, running at least once every seven days needs only a small download. That is the kind of operational detail to plan for in CI.
How to choose
Work through this checklist with your own repositories.
- List your ecosystems and confirm each lockfile type is supported.
- Decide whether you scan source, container images, or both.
- Check which vulnerability database the tool uses and whether it covers your ecosystems.
- Decide if you also need secrets, misconfiguration or license scanning.
- Run two tools on one repository and compare the results by hand.
- Decide who owns triage and where findings will live.
If you only want a quick look first, the free scan at gold.safeguard.sh/scan runs in your browser with no login, keeps your file on your machine, and handles up to 100 dependencies.
Click through it at your own pace, or open it full screen.
Frequently asked questions
Is OSV-Scanner free?
Its documentation site presents it as an open tool that you run yourself. The page we read did not state its license, so check the repository for exact terms.
Can Grype scan an SBOM?
Yes. Its README lists SBOMs as an input, alongside container images and filesystems.
Does Trivy only scan for vulnerabilities?
No. Its documentation lists vulnerability, misconfiguration, secret and license scanners.
Where does Dependency-Check get its data?
Mainly from the NVD data feeds hosted by NIST. For some technologies it also uses sources such as the NPM Audit API, OSS Index, RetireJS and Bundler Audit.
Do I need more than one scanner?
Not necessarily. Running two on the same repository is a useful test, because differences in results show you each tool's data source and matching approach.
Sources
- OSV-Scanner documentation: https://google.github.io/osv-scanner/
- OSV-Scanner supported languages and lockfiles: https://google.github.io/osv-scanner/supported-languages-and-lockfiles/
- Grype repository: https://github.com/anchore/grype
- Trivy repository: https://github.com/aquasecurity/trivy
- Trivy documentation: https://trivy.dev/latest/docs/
- OWASP Dependency-Check: https://owasp.org/www-project-dependency-check/
Last reviewed: 19 October 2026.
