Alternatives to osv-scanner

3 editor-selected alternatives · osv-scanner overview →

source: tools.alternatives · stored order · active records only; review scores are annotations and never change membership or order

A directional evidence panel appears only when the substitute rationale, trade-offs, sources, and verification date have been recorded. Older selections without that panel remain visible but are unclassified under the new evidence contract.

Snyk

86/100freemiumexplicit relation

Snyk is the leading developer security platform providing continuous scanning for vulnerabilities in code (SAST), open-source dependencies (SCA), container images, and infrastructure as code. Integrates directly into IDEs, Git repositories, CI/CD pipelines, and container registries. Features AI-powered fix suggestions, license compliance checking, and real-time vulnerability database. Free for individual developers with paid plans for teams. Supports 30+ programming languages.

Snyk provides a Free tier with basic test limits across SCA, SAST, Container, and IaC security. The Team plan costs $25/month per contributing developer for increased tests and Jira integration. The Ignite plan is $1,260/year per developer for unlimited scans, while Enterprise offers custom governance, SSO, and compliance.Review →

garak

open sourcefreeexplicit relation

garak is NVIDIA's open-source LLM vulnerability scanner for red-teaming AI models and applications. Probes for prompt injection, data leakage, hallucination, toxicity, encoding-based attacks, and dozens of other vulnerability categories. Runs automated attack sequences against any LLM endpoint and generates detailed vulnerability reports. Features a modular probe/detector architecture that is extensible with custom attack patterns. Named after the Star Trek character known for deception.

garak is a 100% open-source LLM vulnerability scanner developed by NVIDIA and the open-source community, released under the Apache 2.0 license. It is completely free to use and automate in CI/CD pipelines.

Shannon

84/100open sourcefreemiumexplicit relation

Shannon is an autonomous white-box AI pentesting tool for web applications and APIs. It analyzes authorized source code, identifies attack vectors, attempts proof-by-exploitation, and produces remediation-ready reports. Shannon Lite is AGPL-3.0 for local use, while Shannon Pro is the commercial Keygraph platform for continuous security testing.

100% open-source and free autonomous AI penetration testing agent developed by Keygraph ($0 software license fee). Self-hosted via Docker with support for automated CI/CD security pipelines. Scan costs depend on user-provided LLM API token consumption (typically $10 to $50 per comprehensive full-application test run depending on code complexity). Commercial licensing and enterprise support are available directly from Keygraph.Review →

Open-source osv-scanner alternatives

garak, Shannon — see all open-source developer tools.

Free osv-scanner alternatives

Snyk, garak, Shannon offer a free plan or free tier.

More AI Security & DevSecOps tools

same category, not editor-selected alternatives — see how osv-scanner compares →

OpenLITOpenLIT is an open-source AI engineering platform that provides OpenTelemetry-native observability for LLM applications. It combines distributed tracing, evaluation, prompt management, a secrets vault, and GPU telemetry in a single self-hostable stack. With 50+ integrations across LLM providers and frameworks, it lets teams monitor AI applications using their existing observability backends like Grafana, Datadog, or Jaeger.CiliumCilium is a CNCF Graduated, Apache-2.0 project for Kubernetes networking, security, and observability using eBPF. It can replace kube-proxy, enforce identity-aware L3-L7 network policies, and add Hubble flow observability plus Tetragon runtime-security signals. Current source checks support GKE Dataplane V2 using Cilium/eBPF and Azure CNI Powered by Cilium for AKS.MCP InspectorMCP Inspector is the official interactive developer tool from the Model Context Protocol team for testing, debugging, and validating MCP servers. It provides a visual interface to inspect available tools, test transport configurations, export configs for different clients, and verify protocol compliance during MCP server development.PlaywrightCross-browser E2E testing framework by Microsoft supporting Chromium, Firefox, and WebKit with one API. Features auto-waiting, tracing with timeline/screenshots/DOM snapshots, codegen for recording tests, and parallel execution. Component testing for React, Vue, Svelte. Built-in API testing, network mocking, and mobile emulation. Known for reliability and speed vs Selenium/Cypress. 70K+ GitHub stars, rapidly becoming the E2E standard.MCP-ScanMCP-Scan is a security tool that scans MCP servers for vulnerabilities including tool poisoning, prompt injection, cross-origin escalation, and rug pull attacks. Acquired by Snyk in 2026, it is the first dedicated security scanner for the MCP ecosystem. It analyzes tool descriptions, permissions, and behavior patterns to detect malicious or compromised MCP servers before they can exploit AI agents.PangolinIdentity-based remote access platform built on WireGuard that combines reverse proxy and VPN capabilities. Pangolin supports clientless browser access for web apps and client-based private-resource access across macOS, iOS, Windows, Linux, and Android, with zero-trust rules, peer-to-peer tunnels, automatic SSL, SSO/OIDC options, and cloud or self-hosted deployment.DeepEvalDeepEval is an Apache-2.0 Python framework for evaluating LLM apps, RAG systems, agents, MCP workflows, and safety behavior with repeatable test cases. It works locally and in CI/CD, then connects to Confident AI for hosted reports, observability, red teaming, and governance when teams need shared evidence instead of ad-hoc prompt reviews and manual QA.reviewdogreviewdog is an open-source automated code review tool that integrates any linter or static analysis tool with GitHub, GitLab, Bitbucket, and Gitea pull requests. Parses output in errorformat, Checkstyle XML, SARIF, and JSON formats to post inline review comments on changed lines only. Works with GitHub Actions, Travis CI, CircleCI, GitLab CI, and Jenkins. Supports 40+ languages through universal linter adapter architecture.LangfuseLangfuse is an open-source LLM engineering platform with 29K+ GitHub stars for tracing, evaluating, and monitoring AI applications. Acquired by ClickHouse, it provides detailed traces of LLM calls, prompt management with versioning, dataset-based evaluation, user feedback collection, and cost tracking. Framework-agnostic with native integrations for LangChain, LlamaIndex, OpenAI SDK, and Vercel AI SDK. Offers both self-hosted deployment and a managed cloud service.

FAQ

Which osv-scanner alternative is listed first?

Snyk is first in the editor-selected list of 3 osv-scanner alternatives and carries an editorial review score of 86/100. The stored order is editorial; review scores do not determine membership or position.

Are there open-source osv-scanner alternatives?

Yes — garak, Shannon are open source.

Are there free osv-scanner alternatives?

Yes — Snyk, garak, Shannon offer a free plan or free tier.