owasp-dep-scan/dep-scan

Health v2 · maintenance only

Adoption not part of the score

1281 stars · 138 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

OWASP dep-scan is a security and risk audit CLI tool that scans project dependencies in local repositories and container images for known CVEs, license issues, and maintenance risks. It performs reachability analysis across multiple language ecosystems and generates SBOM, VDR, and VEX reports for CI integration.

Use cases

• scan project dependencies for known cves
• audit container images for vulnerabilities
• generate sbom with vulnerability disclosure report
• perform reachability analysis on vulnerable packages
• detect dependency confusion attacks
• integrate dependency scanning into ci pipeline
• generate vex documents for compliance

When to choose

• you need local, fast dependency vulnerability scanning without a server
• you want SBOM/VEX/VDR generation for compliance
• you need reachability analysis to prioritize real exploitable vulnerabilities
• you scan multiple ecosystems including containers and Linux distro packages

When to avoid

• you need dynamic application security testing or runtime protection
• you want a hosted SaaS vulnerability management platform with dashboards
• you only need license compliance without vulnerability data

Facets

cli-tool · maturity active

vulnerability-scanning dependency-audit security developer-tools ci-cd security developer-tools windows cli python sbom sca vex cyclonedx supply-chain-security reachability-analysis container-scanning owasp devops linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="owasp-dep-scan/dep-scan")