The Best Open Source Package Health Tools in 2026
We researched open-source package health tools using official vendor websites, including pricing pages, plan tables, and product documentation. Rankings focus on the category’s core job, value for money, and verified features for assessing package risk, managing dependencies, and supporting healthier open-source supply chains.
Our top picks
-
Top ranked
Sonatype Lifecycle#1 of 153.0/10Policy-driven SCA with broad ecosystem coverage, SBOMs, reachability, and continuous monitoring.
Pricing on request
-
Runner-up
Endor Labs#2 of 154.0/10Maps vulnerable dependency reachability and connects findings to remediation workflows.
Free plan · pricing on request
-
Top-ranked free plan
Socket#3 of 155.0/10Broad dependency risk coverage, with cloud-only deployment and paid plans from $25 per developer monthly.
Free plan · paid from $25/mo
Advertiser disclosure: iTechGuides is reader-supported. We may earn a commission when you click some links. How we rank.
The full ranking 15 tools, best first
-
Best forLarge teams needing mature, policy-driven SCA
Policy-driven SCA with broad ecosystem coverage, SBOMs, reachability, and continuous monitoring.
3.0/10★★☆☆☆Visit Sonatype -
Best forTeams needing reachability and automated remediation
Maps vulnerable dependency reachability and connects findings to remediation workflows.
Free plan · pricing on request Our Endor Labs verdict → Visit Endor LabsFor vendors Sponsor this spot · #2 · $99/mo →4.0/10★★☆☆☆Visit Endor Labs -
Best forTeams seeking broad supply-chain risk coverage
Broad dependency risk coverage, with cloud-only deployment and paid plans from $25 per developer monthly.
Free plan · paid from $25/mo Our Socket verdict → Visit SocketFor vendors Sponsor this spot · #3 · $79/mo →5.0/10★★☆☆☆Visit Socket -
Mend Open Source not yet scored
Best forTeams prioritizing dependency security and license controls
Dependency security and license controls with reachability, remediation, and SBOM support.
- Dependency alerts
- SBOM support
- License analysis
—not yet scoredVisit Mend -
Best forTeams managing multi-language runtimes and compliance
A multi-language runtime manager with dependency, vulnerability, license and SBOM controls.
- SBOM support
Free plan · pricing on request · 14-day trial Our ActiveState Platform verdict → Visit ActiveStateFor vendors Sponsor this spot · #5 · $59/mo →6.0/10★★★☆☆Visit ActiveState -
LFX Insights not yet scored
Best forFree assessment of public open-source project health
A free cloud dashboard for assessing public open-source project health and activity.
- Package health scoring
—not yet scoredVisit LFX Insights -
Aikido Package Health not yet scored
Best forFree package-level health checks
Free package scoring that combines maintenance, dependency and provenance signals.
- Package health scoring
—not yet scoredVisit site -
OpenSSF Scorecard not yet scored
Best forOpen-source teams checking repository security practices
A free, open-source tool for scoring repository security practices through CLI or GitHub Actions.
- License analysis
- Package health scoring
—not yet scoredVisit site -
Open Source Insights (deps.dev) not yet scored
Best forDevelopers researching package dependency risks
A free package research service for inspecting dependency graphs and risks.
- License analysis
- Package health scoring
—not yet scoredVisit deps.dev -
DepGuard not yet scored
Best forSmall npm projects wanting CI health checks
Free, open-source npm audits with health grades and CI thresholds.
- Dependency alerts
- License analysis
- Package health scoring
—not yet scoredVisit DepGuard -
OHRisk not yet scored
Best forSmall teams enforcing local license policies
A focused, open-source CLI for teams that need license policy checks in CI.
—not yet scoredVisit OHRisk -
ecosyste.ms not yet scored
Best forResearchers needing open-source package metadata
A broad, open-source metadata toolkit—not a package health-scoring or alerting service.
- SBOM support
- License analysis
—not yet scoredVisit ecosyste.ms -
GrimoireLab not yet scored
Best forOrganizations analyzing open-source project activity
Self-hosted analytics for studying activity across repositories and development systems.
—not yet scoredVisit GrimoireLab -
repo-health-score not yet scored
Best forUsers needing a minimal self-hosted health score
A focused, free, self-hosted way to score repository health.
- Package health scoring
—not yet scoredVisit GitHub -
Photo Curator not yet scored
Best forPhotographers sorting local image libraries
Photo Curator organizes and ranks images, but does not assess software packages.
—not yet scoredVisit Photo Curator
No tools match those filters.
Compare at a glance
| # | Tool | Free plan | Paid from | Package health scoring | Dependency alerts | License analysis | Package ecosystems | Score |
|---|---|---|---|---|---|---|---|---|
| 1 | Sonatype Lifecycle | No | — | — | — | — | C++/Conan; Conda; Dart and Flutter/pub; Go/Go Modules; Hugging Face; Java/Maven, Gradle, Ivy; JavaScript/npm, yarn; .NET/NuGet; Objective-C/CocoaPods; PHP/Composer; Python/PyPI, Poetry, pipenv; R/CRAN; RPM/Yum and Fedora EPEL; Ruby/RubyGems and Bundler; Rust/Cargo; Swift/Swift | 3.0 |
| 2 | Endor Labs | Yes | — | — | — | — | C/C++, Go, Java, JavaScript, Kotlin, .NET (C#), PHP, Python, Ruby, Rust, Scala, Swift, TypeScript, Bazel | 4.0 |
| 3 | Socket | Yes | $25/mo | — | — | — | JavaScript/TypeScript, Python, Go, Java, Ruby, .NET, Scala, Kotlin, Rust, PHP, Swift, C/C++, Julia, Dart, Elixir/Erlang, GitHub Actions | 5.0 |
| 4 | Mend Open Source | — | — | — | Yes | Yes | Conan, NuGet, Go Modules, Maven, Gradle, sbt, Bower, npm, Yarn, Composer, Python (conda, pip, uv), pnpm | — |
| 5 | ActiveState Platform | Yes | — | — | — | — | — | 6.0 |
| 6 | LFX Insights | Yes | None | Yes | — | — | npm, PyPI, Maven, Go | — |
| 7 | Aikido Package Health | Yes | None | Yes | — | — | npm, Packagist, Maven, PyPI | — |
| 8 | OpenSSF Scorecard | Yes | None | Yes | — | Yes | — | — |
| 9 | Open Source Insights (deps.dev) | Yes | None | Yes | — | Yes | Cargo, Go, Maven, npm, NuGet, PyPI, RubyGems | — |
| 10 | DepGuard | Yes | None | Yes | Yes | Yes | npm | — |
| 11 | OHRisk | Yes | None | — | — | — | — | — |
| 12 | ecosyste.ms | Yes | — | No | No | Yes | 109 sources; 52 ecosystems | — |
| 13 | GrimoireLab | Yes | None | No | No | No | Git, GitHub, GitLab, Bugzilla, JIRA, Gerrit, Discourse, Jenkins, Slack, Mattermost, Confluence, MediaWiki | — |
| 14 | repo-health-score | Yes | None | Yes | — | — | — | — |
| 15 | Photo Curator | Yes | None | — | — | — | — | — |
Head-to-head All 27 comparisons →
- Sonatype Lifecycle vs Endor Labs
- Sonatype Lifecycle vs Socket
- Sonatype Lifecycle vs Mend Open Source
- Sonatype Lifecycle vs ActiveState Platform
- Sonatype Lifecycle vs LFX Insights
- Sonatype Lifecycle vs Aikido Package Health
- Sonatype Lifecycle vs OpenSSF Scorecard
- Endor Labs vs Mend Open Source
- Endor Labs vs ActiveState Platform
Explore other topics All topics →
- AI Tools 286 directories · 9,430 tools ranked AI Writing Tools · AI Video Generators · Text-to-Speech Software
- Web Hosting & Domains 234 directories · 8,169 tools ranked Shared Web Hosting · Managed Cloud Hosting · Dedicated Server Hosting
- Productivity 146 directories · 5,502 tools ranked Note-Taking Apps · Calendar Apps · Project Management Software
- Marketing 109 directories · 4,410 tools ranked SEO Tools · Email Marketing Software · Influencer Marketing Platforms
- Sales & CRM 139 directories · 4,945 tools ranked Real Estate CRM Software · CRM Software · Proposal Software
- Customer Service 46 directories · 1,919 tools ranked Chatbot Builders · Knowledge Base Software · Call Center Software
How we rank open source package health tools
Every tool on this page was researched by iTechGuides Editors from its official website — pricing pages, plan tables and product documentation. We rank on how well each one does this category's core job, what the free or entry plan includes, and where it falls short. Where we have enough verified facts, the score out of 10 is a rubric — job fit, value and how much we could verify — shown with its breakdown on every tool's page; a tool we have not verified enough to score yet shows its rank without a number. Scores are re-checked when a product changes its plans. Read the full editorial policy, or submit a tool we missed.
Reviewed by iTechGuides Editors · Editorial team · Updated Sep 2026