OSV-Scanner is an open source command-line scanner that checks project dependencies for known vulnerabilities against the OSV database.
OSV-Scanner is an open source command-line tool that scans project dependencies for known vulnerabilities recorded in the OSV database.
It runs on source repositories and filesystems, and its Go library form lets teams embed dependency scanning into their own tooling.
Google Drive
Nest Protect
Google Cloud — Apigee API Management
Google Cloud Workstations
Google Sheets
Fitbit Versa 4
Google Pixel Watch
Google Custom Search JSON API
Gemini Live API
Nest Wifi Pro
Google Kubernetes Engine
Android — mobile operating system
Android Auto
Google Ads
Managed Service for Apache Spark
Angular
Bazel
Google Business Profile
Google Docs
Google Slides
| Attribute | OSV-Scanner | Trivy | |
|---|---|---|---|
| Provider | |  | |
| Founded | 1998 | 2015 | |
| Sells To | Enterprises, Individuals | Enterprise | |
| Pricing Model | Advertising, Subscription | Usage-based by workloads or repos | |
| Ownership | Subsidiary | Private |
Provider
Founded 1998
Sells To Enterprises, Individuals
Pricing Model Advertising, Subscription
Ownership Subsidiary
Provider
Founded 2015
Sells To Enterprise
Pricing Model Usage-based by workloads or repos
Ownership Private
Snyk Open Source scans open source dependencies for vulnerabilities through CLIs, IDEs, pull requests, and CI/CD pipelines.
Developer-security platform that finds and fixes vulnerabilities in open-source dependencies, containers, and infrastructure as code.
Snyk Open Source scans open source dependencies for vulnerabilities through CLIs, IDEs, pull requests, and CI/CD pipelines.
Docker Scout analyzes container images for vulnerabilities, generating software bills of materials and cross-referencing CVE data for DevOps teams.
Docker Scout analyzes container images for vulnerabilities, generating software bills of materials and cross-referencing CVE data for DevOps teams.
SonarQube add-on extending SAST and SCA to detect CVEs, malicious packages, and license risks with SBOM export.
Free deep AI-powered bug scanning for open-source repositories, finding real bugs in production codebases with full reproduction steps.
AI security agent that hunts intent-based vulnerabilities such as broken access control and business logic flaws.
Snyk Agent Scan is an open-source scanner that checks AI agents, MCP servers, and skills for security issues.
Nebu Code Security continuously scans codebases and pull requests to surface verified vulnerabilities with merge-ready fixes.
Aqua Software Supply Chain Security protects code, tools, and processes against supply chain attacks and AI-specific risks before production.
Automated DAST scanner for web applications and APIs with CI/CD integration.
Snyk Agent Fix automatically generates code fixes for vulnerabilities Snyk identifies in application code.
Platform generating SBOMs and scanning containers for software supply chain security.
DevOps platform for artifact management, SBOM generation, vulnerability scanning, and software supply-chain security.
Grype is an open source vulnerability scanner for containers, source directories, and filesystems with software bill of materials integration.
SonarQube add-on extending SAST and SCA to detect CVEs, malicious packages, and license risks with SBOM export.
Free deep AI-powered bug scanning for open-source repositories, finding real bugs in production codebases with full reproduction steps.
AI security agent that hunts intent-based vulnerabilities such as broken access control and business logic flaws.
Developer-security platform that finds and fixes vulnerabilities in open-source dependencies, containers, and infrastructure as code.
Snyk Agent Scan is an open-source scanner that checks AI agents, MCP servers, and skills for security issues.
Nebu Code Security continuously scans codebases and pull requests to surface verified vulnerabilities with merge-ready fixes.
Aqua Software Supply Chain Security protects code, tools, and processes against supply chain attacks and AI-specific risks before production.
Automated DAST scanner for web applications and APIs with CI/CD integration.
Snyk Agent Fix automatically generates code fixes for vulnerabilities Snyk identifies in application code.
Platform generating SBOMs and scanning containers for software supply chain security.
DevOps platform for artifact management, SBOM generation, vulnerability scanning, and software supply-chain security.