Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

cargo-deny

Free#55 of 65 in Software Composition Analysis Software

cargo-deny: A Rust-focused policy checker for Cargo dependency graphs, with CI and pre-commit support. Ranked #55 of 65 in Software Composition Analysis Software by our editors (5.3/10); pricing: Open source; best for rust teams enforcing Cargo dependency policies.

5.3/10Editor score
Visit cargo-deny
cargo-deny5.3 Visit cargo-deny

At a glance

  • Editor score
    5.3 / 10
  • Pricing
    Open source
  • Best for
    Rust teams enforcing Cargo dependency policies
  • Paid from
    Free
  • Facts checked
    19 Sep 2026
cargo-deny screenshot

  • Where it wins

    • Checks crate licenses, security advisories, and unmaintained or yanked crates
    • Controls banned crates, duplicate versions, and dependency sources
    • Runs in GitHub Actions and pre-commit, with a Rust library API

  • Where it doesn't

    • Focused on Rust and Cargo rather than multiple ecosystems
    • Requires teams to define and maintain dependency policies
    • No verified SBOM generation or reachability analysis

Our verdict on cargo-deny

Rust teams that need policy checks on Cargo dependency graphs can use cargo-deny as a command-line tool, a CI step, or a local pre-commit hook. It evaluates dependencies against project-defined rules, covering crate licenses, known security advisories, unmaintained or yanked crates, duplicate versions, banned crates, and dependency source locations. Its Rust library API also supports programmatic use. This makes it a focused option for teams that want dependency review to be part of their development workflow rather than a broader, cross-language SCA system.

The tool’s strongest fit is its range of Cargo-specific controls. License checks use SPDX expressions, while source policies can allow or restrict registries, Git sources, and paths. Teams can lint the dependency graph and apply those checks to pull requests through GitHub Actions, or catch issues locally with pre-commit. It supports Rust, Cargo, crates.io, Git registries, and Git repositories, and is self-hosted. That scope suits Rust projects with explicit rules for acceptable licenses, sources, and dependency versions; it is not a general dependency-policy layer for teams working across different ecosystems.

cargo-deny is open source, and the documented options include local installation from source or precompiled binaries. The listed integrations—GitHub Actions and pre-commit—cover CI and developer workflows, while the library API offers another route for embedding checks. Its narrow focus is also a boundary: teams seeking a broader SCA tool should compare alternatives if they need cross-ecosystem coverage, SBOM generation, or reachability analysis. Choose cargo-deny when Cargo policy enforcement is the priority; look elsewhere when those broader capabilities are central to the evaluation.

Your product? Our editors can test cargo-deny in depth and publish a review, labelled as paid · from $149/mo →

cargo-deny pricing

Plans Open sourceFree Free to use — no paid tier required for the core job.
See plans on embarkstudios.github.io

cargo-deny fact sheet

Free planNot verified
Paid fromFree
Supported ecosystemsRust; Cargo; crates.io; Git registries; Git repositories
SBOM generationNot verified
Reachability analysisNot verified
Pull request scanningYes
Monitored projectsNot verified
Deployment optionsSelf_hosted
DeploymentDesktop
PlatformsWindows, macOS, Linux
Integrations2 integrations: GitHub Actions, pre-commit
PricingOpen source
Websiteembarkstudios.github.io
Facts checked19 Sep 2026

cargo-deny integrations

cargo-deny lists 2 integrations on its own site.

  • GitHub Actions
  • pre-commit

Alternatives to cargo-deny

See all cargo-deny alternatives →

Used cargo-deny? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used cargo-deny for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Your rating

0 characters · at least 80, up to 3,000

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

Featured on iTechGuides — cargo-deny 5.3/10

cargo-deny is listed in our Software Composition Analysis Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/cargo-deny/"><img src="https://www.itechguides.com/best/badge/cargo-deny.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update