# XmirrorSecurity/OpenSCA-cli

OpenSCA is an open source software supply chain security solution that supports the detection of open source dependencies, vulnerabilities and license compliance with a widely noticed accuracy by the community.

Repository: https://github.com/XmirrorSecurity/OpenSCA-cli
Canonical: https://ross.abutalabs.com/products/opensca-cli
Homepage: https://opensca.xmirror.cn
Language: Go
License: Apache-2.0
License Family: permissive
Topics: sca, devsecops, security, sbom, software-bill-of-materials, software-composition-analysis, software-supply-chain, software-supply-chain-security, license-compliance, cyclonedx, spdx, swid
Last push: 2026-05-15T11:52:02+00:00

## Health v2 (maintenance only)
Score: 82/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 82, release rhythm 72, longevity 100
- inputs: {"age_days": 1707, "days_push": 110, "days_rel": 110, "gap_med": 64, "n_releases_24m": 6}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1125, forks 134 (observed 2026-08-28T04:03:41.042226+00:00)

## What it is
OpenSCA-cli is an open-source Software Composition Analysis (SCA) command-line tool that scans projects to detect third-party open-source dependencies, known vulnerabilities, and license compliance risks. It generates SBOM reports in standards like SPDX, CycloneDX, and SWID, supports many language ecosystems (Java, JavaScript, Go, Python, Rust, etc.), and integrates via CLI, IDE plugins, and CI/CD pipelines.

## Use cases
- scan project dependencies for known vulnerabilities
- generate an SBOM for my repository
- check open-source license compliance of dependencies
- detect transitive dependencies in go.mod or package-lock.json
- integrate SCA scanning into CI/CD pipeline
- audit third-party components for supply chain risks
- find which dependency versions fix a CVE like log4shell

## When to choose
- you need a free, open-source SCA tool with multi-language dependency parsing
- you want SBOM generation in SPDX/CycloneDX/SWID formats
- you need offline or self-hosted vulnerability scanning with configurable vulnerability databases
- you want lightweight CLI/IDE/CI integration for supply chain security

## When to avoid
- you need commercial-grade support, private component repository analysis, or enterprise policy management
- you need dynamic analysis or SAST/DAST rather than dependency composition analysis
- your ecosystem is not among the supported package managers

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, vulnerability-scanning, dependency-audit, parser, cli, developer-tools
- domain: security, developer-tools, legal
- platform: windows, cli, cross-platform
- tags: sca, sbom, software-composition-analysis, supply-chain-security, license-compliance, cyclonedx, spdx, devsecops, vulnerability-detection, dependency-scanning, devops, open-source, linux, macos, docker

## Member repositories
- XmirrorSecurity/OpenSCA-cli (main) score 82

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:41.042226+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:39:22.601786+00:00, confidence not recorded.
  - readme: https://github.com/XmirrorSecurity/OpenSCA-cli (fetched 2026-08-28T04:03:41.042226+00:00, sha 7bdb46c9f03c)
  - homepage: https://opensca.xmirror.cn (fetched 2026-08-29T12:43:58.055219+00:00, sha 3ec963c5cd71)
  - site_page: https://opensca.xmirror.cn/docs/v1 (fetched 2026-08-29T12:43:58.086524+00:00, sha 985107bba98c)
  - site_page: https://opensca.xmirror.cn/about (fetched 2026-08-29T12:43:58.088815+00:00, sha 723b15008c88)
- Data as of 2026-08-30T08:39:29.467469+00:00.