Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

cargo-audit

Free#64 of 65 in Software Composition Analysis Software

cargo-audit: A focused open-source CLI for RustSec checks, reports, and dependency review. Ranked #64 of 65 in Software Composition Analysis Software by our editors (5.3/10); pricing: Open source; best for rust teams auditing Cargo dependencies.

5.3/10Editor score
Visit RustSec
cargo-audit5.3 Visit RustSec

At a glance

  • Editor score
    5.3 / 10
  • Pricing
    Open source
  • Best for
    Rust teams auditing Cargo dependencies
  • Paid from
    Free
  • SBOM generation
    No
  • Facts checked
    19 Sep 2026
cargo-audit screenshot

  • Where it wins

    • Checks Cargo.lock against the RustSec Advisory Database
    • Supports terminal, JSON, and SARIF reports with dependency trees
    • Scans compiled binaries and supports advisory ignore rules

  • Where it doesn't

    • Supports only the Rust / Cargo ecosystem
    • Does not generate SBOMs or perform reachability analysis
    • Does not provide native pull-request scanning

Our verdict on cargo-audit

cargo-audit is an open-source command-line tool for Rust developers and security teams reviewing Cargo dependencies. It audits Cargo.lock files against the RustSec Advisory Database, reports known Rust crate vulnerabilities, and shows related dependency information. The tool runs locally as a Cargo subcommand on Linux and macOS, making it suited to teams that want self-hosted dependency checks rather than a hosted service.

Its strongest capability is focused Rust dependency auditing. Results can appear in terminal, JSON, or SARIF formats, while dependency trees help connect advisories to the packages that bring them into a project. cargo-audit can also check for yanked crates in Cargo.lock and scan compiled binaries through its bin subcommand when dependency metadata is embedded. Advisory ignore rules and audit.toml configuration provide control over how checks are applied. An experimental cargo audit fix command can update vulnerable dependency requirements, but teams should treat that as an optional remediation aid rather than a complete dependency update workflow.

The open-source pricing model suits teams that can incorporate a command-line tool into their own development and CI processes. Integrations include RustSec Advisory Database, cargo-auditable, GitHub Actions through rust-audit-check, and Travis CI. Its scope is intentionally narrow: it supports Rust / Cargo, does not generate SBOMs, does not perform reachability analysis, and does not provide native pull-request scanning. Rust teams seeking advisory checks, dependency context, and machine-readable reports should consider cargo-audit; organizations needing broader multi-ecosystem analysis or those capabilities should choose a different tool.

Your product? Our editors can test cargo-audit in depth and publish a review, labelled as paid · from $149/mo →

cargo-audit pricing

Plans Open sourceFree Free to use — no paid tier required for the core job.
See plans on rustsec.org

cargo-audit fact sheet

Free planNot verified
Paid fromFree
Supported ecosystemsRust / Cargo
SBOM generationNo
Reachability analysisNo
Pull request scanningNo
Monitored projectsNot verified
Deployment optionsSelf_hosted
DeploymentDesktop
PlatformsLinux, macOS
Integrations4 integrations: RustSec Advisory Database, cargo-auditable, GitHub Actions via rust-audit-check, Travis CI
PricingOpen source
Websiterustsec.org
Facts checked19 Sep 2026

cargo-audit integrations

cargo-audit lists 4 integrations on its own site.

  • RustSec Advisory Database
  • cargo-auditable
  • GitHub Actions via rust-audit-check
  • Travis CI

Alternatives to cargo-audit

See all cargo-audit alternatives →

Used cargo-audit? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used cargo-audit for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Your rating

0 characters · at least 80, up to 3,000

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

Featured on iTechGuides — cargo-audit 5.3/10

cargo-audit is listed in our Software Composition Analysis Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/cargo-audit/"><img src="https://www.itechguides.com/best/badge/cargo-audit.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update