9 software composition analysis apps in one list: the established products, and every new one as it launches.
Updated
4 apps launched in the last 12 months, by month.
“software composition analysis tool” is searched 1,600 times a month on Google worldwide. These are the 19 searches around it, in the US.
| Search | Per month, US | Cost per click |
|---|---|---|
| static code analysis tools | 1,900 | $54.78 |
| sast tools | 1,300 | $65.77 |
| dast tools | 880 | $43.48 |
| sca tools | 390 | $28.47 |
| open source vulnerability scanner tools | 90 | $17.27 |
| sca vs sbom | 40 | - |
| sast tools list | 30 | $55.21 |
| sast and sca tools | 20 | - |
| security testing tools open source | 20 | - |
| software composition analysis vs static code analysis | 20 | - |
| automated pen testing tools open-source | 10 | - |
| sast tools examples | 10 | $12.75 |
| sast tools free | 10 | - |
| sast tools github | 10 | - |
| sast tools open-source | 10 | - |
Cost per click is what advertisers bid for one visit from that search. Figures from Oct 2026.
The apps we added to this market most recently.
| # | App | Added |
|---|---|---|
| 1 |  LegacyFixer Compared with Dependabot and Renovate, LegacyFixer focuses on security-first scanning of Python dependencies. It reports vulnerability findings even when an automated fix is not appropriate, and creates a fix pull request only when its policy and validation checks allow it. Each scan produces an explicit outcome, including detect-only (NO_ACTION) when no fix PR is created. LegacyFixer runs as a GitHub App on Google Cloud Run. | |
| 2 | Snyk Every AI-building team faces one question: can you trust what you're shipping? Snyk secures the code AI writes, the agents it runs, and the apps it builds. Get started for free or book a demo. | |
| 3 | Binarly Binarly is an enterprise security platform designed to detect firmware vulnerabilities, misconfigurations, secrets, and malicious code within software supply chains. Using advanced program analysis, B | |
| 4 | EOL Dataset Your SCA checks for CVEs. It doesn't check whether anyone is still maintaining the software. That's a different question, and until now, no tool answered it well. We track lifecycle status across 12M+ package versions using official EOL declarations and ML-based detection of maintainer abandonment. Upload a package.json, pom.xml, requirements.txt, or any SBOM and see exactly what's still maintained and what isn't. Direct and transitive deps. Every major ecosystem. Free of charge. | |
| 5 | PR Protean Labs Scans your code's dependencies and alerts you if any have vulnerabilities | |
| 6 | TR Trace-AI Trace-AI predicts and prevents supply-chain attacks via metadata-driven analysis of open-source dependencies, registries, and maintainer activity, no source code needed. Built by engineers who scaled to millions, it helps teams ship fast and secure. | |
| 7 | Corgea Corgea is an AI-powered security platform that automatically finds, triages, and fixes insecure code. Sign up today for free to try Corgea. | |
| 8 | Xeol Find End of Life (EOL) software in your cloud infrastructure |
The products every new one is compared with.
| App | Launched | Monthly visits | Store ratings |
|---|---|---|---|
| * | 62,459 | - |
* Launch date estimated.
What we could detect on their websites.
| Host | Apps | Share |
|---|---|---|
| Vercel | 3 | 100.0% |
Of 3 apps whose host we could detect.
How many of the 9 apps show a price, and how many sell to large companies.
| Measure | Apps | Share of 9 |
|---|---|---|
| Publish a pricing page | 5 | 55.6% |
4 more searches around “software composition analysis tool” on Starter and Pro. See plans
2 more answers about software composition analysis apps with Starter.See plans