OSV-Scanner
OSV-Scanner: A flexible OSV-based scanner for teams that can work with CLI and GitHub workflows. Ranked #23 of 65 in Software Composition Analysis Software by our editors (7.0/10); pricing: Free plan; best for teams centered on OSV vulnerability data.
At a glance
- Editor score7.0 / 10
- PricingFree plan
- Best forTeams centered on OSV vulnerability data
- Free planYes
- Paid fromFree
- SBOM generationYes
- Facts checked22 Sep 2026
Where it wins
- Scans source, lockfiles, SBOMs, containers, and vendored code
- Supports SPDX, CycloneDX, JSON, SARIF, and HTML outputs
- Adds scheduled and pull-request workflows through GitHub Actions
Where it doesn't
- Integration coverage is narrower than broader SCA platforms
- Call analysis is limited to supported Go and Rust projects
- Uses CLI and workflows rather than a hosted SaaS dashboard
Our verdict on OSV-Scanner
OSV-Scanner is an open-source command-line vulnerability scanner from Google for developers and security teams. It connects project dependencies and container packages with the OSV database, covering source directories, lockfiles, SBOMs, Git repositories, and container images. Teams can run it locally, in CI/CD pipelines, or through its Go library. It fits organizations that want self-hosted scanning centered on OSV data, especially those comfortable managing CLI-based security workflows.
The published plan structure is simple: the Open source plan includes CLI and Go library usage, local and CI/CD scanning, plus source, SBOM, and container scanning. There are no paid tiers to compare. The scanner supports Windows, macOS, and Linux, and can produce JSON, SARIF, HTML, SPDX, and CycloneDX output. Its GitHub Action adds scheduled and pull-request scanning workflows, while OSV.dev supplies the vulnerability-data connection. This makes the product practical for teams already working with GitHub Actions and standard software bills of materials.
Coverage spans C/C++, Dart, Elixir, Go, Haskell, Java, JavaScript, .NET, PHP, Python, R, Ruby, and Rust, along with selected Alpine, Debian/Ubuntu, Ubuntu chiseled, and container package ecosystems. Container analysis includes packages and layers, and optional call analysis identifies whether vulnerable functions are executed in supported Go and Rust projects. Those capabilities give OSV-Scanner useful depth, but its integration and feature breadth are narrower than platforms built around hosted monitoring and larger ecosystem connections. Choose it for open-source, self-hosted scanning and OSV-focused workflows; consider an alternative if you need a hosted SaaS dashboard or broader integrations.
Your product? Our editors can test OSV-Scanner in depth and publish a review, labelled as paid · from $149/mo →
OSV-Scanner pricing
OSV-Scanner fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Supported ecosystems | C/C++, Dart, Elixir, Go, Haskell, Java, JavaScript, .NET, PHP, Python, R, Ruby, Rust; npm, pip, Maven, Go Modules, Cargo, Gem, Composer, NuGet |
| SBOM generation | Yes |
| Reachability analysis | Yes |
| Pull request scanning | Yes |
| Monitored projects | Not verified |
| Deployment options | Self_hosted |
| Deployment | Self-hosted |
| Platforms | Windows, macOS, Linux |
| Support | Community, Docs |
| Built for | Solo, Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 3 integrations: GitHub Actions, pre-commit, Docker |
| Pricing | Free plan |
| Website | google.github.io |
| Facts checked | 22 Sep 2026 |
OSV-Scanner integrations
OSV-Scanner lists 3 integrations on its own site.
- GitHub Actions
- pre-commit
- Docker
Alternatives to OSV-Scanner
- Snyk Open SourceBroad SCA coverage with reachability, SBOMs, pull-request scanning, and monitoring.9.4
- FOSSAA mature SCA platform covering dependencies, SBOMs, containers, licenses, and policy controls.9.3
- Safeguard SCAA budget-conscious SCA platform with reachability analysis, SBOMs, and remediation workflows.9.1
See all OSV-Scanner alternatives →
Used OSV-Scanner? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used OSV-Scanner for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
OSV-Scanner is listed in our Software Composition Analysis Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/osv-scanner/"><img src="https://www.itechguides.com/best/badge/osv-scanner.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update