Twira Dependency Vulnerabilities
Twira Dependency Vulnerabilities: A focused offline SCA tool for lockfile scanning across nine dependency ecosystems. Ranked #53 of 65 in Software Composition Analysis Software by our editors (5.3/10); pricing: Free plan · 14-day trial; best for offline teams scanning common lockfile ecosystems.
At a glance
- Editor score5.3 / 10
- PricingFree plan · 14-day trial
- Best forOffline teams scanning common lockfile ecosystems
- Free planYes
- Paid from$29.99/mo
- SBOM generationNo
- Facts checked19 Sep 2026
Where it wins
- Offline and air-gapped scanning with a local vulnerability cache
- Reachability filtering separates installed and imported dependencies
- JSON and SARIF 2.1.0 output supports structured security workflows
Where it doesn't
- No SBOM generation
- Focused on application dependencies, not containers or operating systems
- Free plan does not include the listed vulnerability-scanning features
Our verdict on Twira Dependency Vulnerabilities
Twira Dependency Vulnerabilities is a local-first software composition analysis tool for developers and security teams. It scans dependency lockfiles across npm, Cargo, PyPI, Go, Maven, RubyGems, Packagist, NuGet, and Swift Package Manager against the OSV vulnerability database. The tool runs on Windows, macOS, and Linux as part of Twira Diagnose from an editor or terminal, with a focus on application dependencies rather than containers or operating systems.
Pricing is split between a Free plan and Pro. Free costs $0 on install and includes graph code intelligence for personal use, Index, Code Search, and Code Read. Pro costs $29.99 per month and adds dependency-vulnerability scanning with reachability filtering, OSV, GitHub Security Advisories, and language-specific feeds, plus SARIF 2.1.0 output and 65 deterministic detectors. A 14-day trial is available. The paid tier is therefore the relevant choice for teams evaluating vulnerability findings, while the Free plan is aimed at personal code intelligence.
The standout capability is local filtering of dependency findings. Twira applies two tiers of filtering for installed packages and imported modules, helping distinguish dependencies present in a lockfile from those connected to application code. Offline cached scans, a 24-hour local vulnerability-cache TTL, drift-resilient suppressions, structured JSON output, and an append-only Merkle audit chain for detection events support controlled workflows where local operation matters. Teams needing air-gapped scanning and focused lockfile analysis should consider Twira; teams requiring SBOM generation or coverage for containers and operating systems should choose a broader tool.
Your product? Our editors can test Twira Dependency Vulnerabilities in depth and publish a review, labelled as paid · from $149/mo →
Twira Dependency Vulnerabilities pricing
All 2 Twira Dependency Vulnerabilities plans and prices →
Twira Dependency Vulnerabilities fact sheet
| Free plan | Yes |
|---|---|
| Paid from | $29.99/mo |
| Supported ecosystems | npm, Cargo, PyPI, Go, Maven, RubyGems, Packagist, NuGet, Swift Package Manager |
| SBOM generation | No |
| Reachability analysis | Yes |
| Pull request scanning | Not verified |
| Monitored projects | Not verified |
| Deployment options | Self_hosted |
| Free trial | 14 days |
| Deployment | Desktop |
| Platforms | Windows, macOS, Linux |
| Integrations | 2 integrations: OSV, GitHub Security Advisories |
| Pricing | Free plan · 14-day trial (source) |
| Website | twira.com |
| Facts checked | 19 Sep 2026 |
Twira Dependency Vulnerabilities integrations
Twira Dependency Vulnerabilities lists 2 integrations on its own site.
- OSV
- GitHub Security Advisories
Alternatives to Twira Dependency Vulnerabilities
- Snyk Open SourceBroad SCA coverage with reachability, SBOMs, pull-request scanning, and monitoring.9.4
- FOSSAA mature SCA platform covering dependencies, SBOMs, containers, licenses, and policy controls.9.3
- Safeguard SCAA budget-conscious SCA platform with reachability analysis, SBOMs, and remediation workflows.9.1
See all Twira Dependency Vulnerabilities alternatives →
Used Twira Dependency Vulnerabilities? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Twira Dependency Vulnerabilities for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Twira Dependency Vulnerabilities is listed in our Software Composition Analysis Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/twira-dependency-vulnerabilities/"><img src="https://www.itechguides.com/best/badge/twira-dependency-vulnerabilities.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update