Marshal review
Open-source Maven and Gradle scanning that scores update risk before merge.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Marshal is an open-source dependency security tool for Java teams using Maven or Gradle. It monitors dependency versions and metadata on Maven Central, then evaluates updates against behavioral signals such as maintainer changes, signature changes, dependency explosions, repository changes, unusual version jumps, and yanked versions. Teams can scan local projects through its CLI or run it as a GitHub Action during pull requests. Its focus is update risk rather than broad ecosystem coverage, making it a fit for JVM teams that want additional review before accepting dependency changes.
The central feature is its 0–100 risk score, supported by evidence about the detected change. GitHub checks can fail for risky updates, while human-readable, JSON, and Markdown output supports different review workflows. Slack webhook alerts are available for critical findings, and a whitelist supports pinned, audited suppression of known findings. This gives teams several ways to place review in development workflows without limiting the tool to pull requests. Marshal complements conventional CVE scanners rather than replacing them, so teams looking for vulnerability alerting need another product alongside it.
Marshal is free and open source, with self-hosted deployment and integrations for GitHub Actions, Slack, and Maven Central. The narrow Maven and Gradle scope is its main trade-off: it suits JVM dependency teams but not organizations managing ecosystems outside those build systems. Teams that want behavioral signals around dependency updates, local CLI scanning, and pull-request enforcement should consider it. Teams needing broader language coverage, hosted deployment today, or vulnerability alerts should choose an alternative or pair Marshal with additional tooling.
Marshal pros and cons
- Where it wins
- Scores dependency updates on a clear 0–100 risk scale
- Detects maintainer, signature, repository, version, and dependency changes
- Runs locally or in GitHub pull requests with Slack alerts
- Where it doesn't
- Coverage is limited to Maven and Gradle projects
- Does not provide vulnerability alerts
- Requires self-hosted deployment today
Marshal fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update