ts-scan
ts-scan: A focused, free SCA scanner for CI teams that need broad dependency and SBOM checks. Ranked #47 of 65 in Software Composition Analysis Software by our editors (5.3/10); pricing: Free plan; best for open-source teams needing lightweight CI SCA.
At a glance
- Editor score5.3 / 10
- PricingFree plan
- Best forOpen-source teams needing lightweight CI SCA
- Free planYes
- Paid fromFree
- SBOM generationYes
- Facts checked19 Sep 2026
Where it wins
- Scans direct and transitive dependencies across supported ecosystems
- Generates TrustSource, SPDX, and CycloneDX SBOMs
- Adds license, malware, cryptography, Docker, and CI policy checks
Where it doesn't
- No reachability analysis for prioritizing exploitable dependency paths
- No pull-request scanning workflow
- Ecosystem coverage is narrower than broader SCA platforms
Our verdict on ts-scan
ts-scan is an open-source command-line software composition analysis tool for development and DevOps teams. It is designed for local scanning, Docker-based operation, and CI/CD automation, with API and self-hosted deployment options. The scanner detects direct and transitive dependencies across Maven, Gradle, npm, PyPI, NuGet, Dart, Visual Basic 6, Go, and Docker/Syft workflows. Teams that want a free, code-oriented way to inspect open-source components and generate software bills of materials will find its focus a good fit.
Its strongest area is coverage across several software supply-chain checks in one scanner. ts-scan can generate SBOMs in TrustSource, SPDX, and CycloneDX formats, check components against the TrustSource vulnerability database, and analyze licenses and copyrights. It also scans for malware and cryptographic algorithms, while Docker image and filesystem scanning is provided through Syft. Results and third-party SBOMs can be uploaded or imported, including through the TrustSource API and related tooling. CI/CD automation and build-failure policy checks make it suitable for teams that want dependency controls to run as part of builds rather than as a separate review step.
The trade-off is a narrower SCA scope than teams may expect from a larger application-security platform. ts-scan does not provide reachability analysis or pull-request scanning, so it is less suited to prioritizing vulnerabilities by actual code paths or managing dependency findings directly in pull-request workflows. Its ecosystem list is also focused rather than expansive. Choose ts-scan when open-source deployment, self-hosting, SBOM output, and straightforward CI policy enforcement matter most. Teams that need reachability, pull-request analysis, or broader ecosystem coverage should choose an alternative SCA product.
Your product? Our editors can test ts-scan in depth and publish a review, labelled as paid · from $149/mo →
ts-scan pricing
ts-scan fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Supported ecosystems | Maven, Gradle, npm, PyPI, NuGet, Dart, Visual Basic 6, Go, Docker/Syft |
| SBOM generation | Yes |
| Reachability analysis | No |
| Pull request scanning | No |
| Monitored projects | Not verified |
| Deployment options | Self_hosted |
| Deployment | Self-hosted |
| Integrations | 7 integrations: GitHub Actions, Docker, Syft, TrustSource API, SCANOSS, SPDX … |
| Pricing | Free plan |
| Website | trustsource.io |
| Facts checked | 19 Sep 2026 |
ts-scan integrations
ts-scan lists 7 integrations on its own site.
- GitHub Actions
- Docker
- Syft
- TrustSource API
- SCANOSS
- SPDX
- CycloneDX
Alternatives to ts-scan
- Snyk Open SourceBroad SCA coverage with reachability, SBOMs, pull-request scanning, and monitoring.9.4
- FOSSAA mature SCA platform covering dependencies, SBOMs, containers, licenses, and policy controls.9.3
- Safeguard SCAA budget-conscious SCA platform with reachability analysis, SBOMs, and remediation workflows.9.1
See all ts-scan alternatives →
Used ts-scan? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used ts-scan for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
ts-scan is listed in our Software Composition Analysis Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/ts-scan/"><img src="https://www.itechguides.com/best/badge/ts-scan.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update