Twira Dependency Vulnerabilities review
A focused offline SCA tool for lockfile scanning across nine dependency ecosystems.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Twira Dependency Vulnerabilities is a local-first software composition analysis tool for developers and security teams. It scans dependency lockfiles across npm, Cargo, PyPI, Go, Maven, RubyGems, Packagist, NuGet, and Swift Package Manager against the OSV vulnerability database. The tool runs on Windows, macOS, and Linux as part of Twira Diagnose from an editor or terminal, with a focus on application dependencies rather than containers or operating systems.
Pricing is split between a Free plan and Pro. Free costs $0 on install and includes graph code intelligence for personal use, Index, Code Search, and Code Read. Pro costs $29.99 per month and adds dependency-vulnerability scanning with reachability filtering, OSV, GitHub Security Advisories, and language-specific feeds, plus SARIF 2.1.0 output and 65 deterministic detectors. A 14-day trial is available. The paid tier is therefore the relevant choice for teams evaluating vulnerability findings, while the Free plan is aimed at personal code intelligence.
The standout capability is local filtering of dependency findings. Twira applies two tiers of filtering for installed packages and imported modules, helping distinguish dependencies present in a lockfile from those connected to application code. Offline cached scans, a 24-hour local vulnerability-cache TTL, drift-resilient suppressions, structured JSON output, and an append-only Merkle audit chain for detection events support controlled workflows where local operation matters. Teams needing air-gapped scanning and focused lockfile analysis should consider Twira; teams requiring SBOM generation or coverage for containers and operating systems should choose a broader tool.
Twira Dependency Vulnerabilities pros and cons
- Where it wins
- Offline and air-gapped scanning with a local vulnerability cache
- Reachability filtering separates installed and imported dependencies
- JSON and SARIF 2.1.0 output supports structured security workflows
- Where it doesn't
- No SBOM generation
- Focused on application dependencies, not containers or operating systems
- Free plan does not include the listed vulnerability-scanning features
Twira Dependency Vulnerabilities fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update