Open Source SCA Tools Compared: OSV-Scanner, Trivy, Grype

The main open source SCA tools are OSV-Scanner, Trivy, Grype with Syft, and OWASP Dependency-Check. All find known vulnerabilities in dependencies. They differ in data source, scan targets and extras. OSV-Scanner centers on lockfiles, Trivy and Grype also cover images, and Dependency-Check matches components by CPE.

Safeguard publishes this guide and sells a competing product, so we describe other tools only from their own documentation.

Key takeaways

• All four tools are free to use and run in a terminal or CI.
• The biggest difference is the vulnerability data source, which changes what each tool can find.
• Trivy and Grype are strongest where a project also ships container images.
• None of the pages we read describe reachability analysis for these tools, so expect to triage by hand.
• Language specific tools such as npm audit and pip-audit are narrower, and sometimes the right fit.

What are the main open source SCA tools?

Four general purpose tools cover most needs, plus a few ecosystem tools. The table lists what each project's own documentation said on 19 October 2026.

How does OSV-Scanner work?

OSV-Scanner links your dependencies to vulnerabilities in the OSV database. Its documentation calls it an officially supported frontend to that database and says you can run it in a terminal or CI pipeline.

It reads lockfiles across many ecosystems, including package-lock.json, pnpm-lock.yaml, yarn.lock, poetry.lock, uv.lock, Cargo.lock, go.mod, Gemfile.lock and composer.lock, and for Java it reads pom.xml and Gradle lockfiles. Maven transitive resolution is on by default. A recursive scan walks a directory tree. An offline mode matches against locally cached databases.

How does Trivy handle dependencies?

Trivy detects known vulnerabilities in the components it finds in the scan target. For language packages it uses data such as the GitHub Advisory Database, the Go Vulnerability Database and the Ruby Advisory Database. It lists PHP, Python, Ruby, Node.js, Java, Go, Rust, .NET, C and C++, Dart, Elixir and Swift.

A filesystem scan looks for vulnerabilities from lock files such as Gemfile.lock and package-lock.json. Vulnerability and secret scanning are on by default, and license scanning is off until you enable it. Trivy sorts licenses with the Google License Classification, so a forbidden license shows as critical and a restricted one as high.

How do Grype and Syft split the work?

Syft generates the SBOM and Grype matches it against known vulnerabilities. Syft's page describes it as a CLI tool and Go library that produces CycloneDX, SPDX and its own JSON format, from images, directories and archives. Grype scans images, filesystems and SBOMs, including one Syft made.

Grype's page says it uses EPSS, KEV and risk scoring to prioritize, and that it supports OpenVEX to filter results. If you need to store an SBOM and rescan it later, the split is handy.

How does OWASP Dependency-Check differ?

Dependency-Check matches by evidence rather than only by package name and version. Its analyzers collect evidence about each dependency to identify a Common Platform Enumeration, and if one is found the report lists the related CVE entries. It updates from the NVD data feeds.

That approach fits Java well, where it integrates with Maven, Gradle and Ant. The page does not discuss false positives, so test on your own repository and tune the suppressions you need.

What about npm audit and pip-audit?

Ecosystem tools are narrower and simple. The npm CLI's audit command sends your dependency description to your registry and reports known vulnerabilities. By default npm needs a package-lock or shrinkwrap file to run it.

pip-audit, maintained under the Python Packaging Authority, scans Python environments and uses the Python Packaging Advisory Database through the PyPI JSON API by default, with OSV as an option. Its own page warns that it does not defend against malicious packages. Use these when a repository holds only one ecosystem.

What do open source SCA tools leave out?

Open source scanners tell you what is vulnerable. They rarely decide what matters or keep history. Before you commit, plan for:

• Triage. None of the pages we read describe reachability analysis for these tools.
• Policy. Gating rules, exceptions and approvals are yours to script.
• Reporting. Dashboards, trend lines and audit exports need another layer.
• Data lag. Each tool inherits the freshness of its data source.

For a quick check with no install, the free in-browser scan takes a manifest or SBOM, parses it locally and checks up to 100 dependencies. Safeguard also offers reachability analysis and SBOM generation and import if you outgrow scripts.

How to choose among them

• Containers in the mix: start with Trivy or Grype.
• Lockfile heavy source repositories in many languages: start with OSV-Scanner.
• Java with Maven or Gradle builds and an existing Jenkins setup: look at Dependency-Check.
• Need an SBOM first and scans later: Syft plus Grype.
• Single ecosystem and minimal setup: npm audit or pip-audit.
• Run two tools on one repository for a week and compare the findings before you decide.

Frequently asked questions

Sources

• OSV-Scanner documentation
• OSV-Scanner supported languages and lockfiles
• OSV-Scanner usage
• Trivy vulnerability scanning
• Trivy filesystem target
• Trivy license scanning
• Grype on GitHub
• Syft on GitHub
• OWASP Dependency-Check
• npm audit
• pip-audit

Last reviewed: 19 October 2026.