Stack Gems
Menu
WorkbenchBestNewSkillsLogAboutSubmit

Alternatives · Security

Ghidra alternatives (2026)

Ghidra: The free standard for looking inside binaries — expect a learning curve, and pair it with an MCP bridge if your agent should help.

Its Catch: A heavy Java desktop app — the 12.1 release needs a 64-bit JDK 21, and Python 3 for the debugger and PyGhidra.

Below: 8 free or free-tier tools from the same category (security tools), free and open source first, then the closest match by shared tags. Each keeps its own Catch.

  1. 1.TrivyApache-2.0 all-in-one vuln/IaC/secret/SBOM scanner; no paid tier

    Free / OSS · Apache-2.0 · 38.5k GitHub stars

    VerdictApache-2.0 security scanner. Fully free CLI; Aqua Platform is the paid cousin.

    CatchCLI/CI scanner — not Aqua Platform management UI/RBAC/policy SaaS. Vs Grype/Snyk: Aqua OSS default with broad target surface; Aqua Inc monetizes a separate commercial platform. You still triage and patch.

  2. 2.CosignApache-2.0 Sigstore keyless container/artifact signing CLI

    Free / OSS · Apache-2.0 · 6.4k GitHub stars

    VerdictApache-2.0 Sigstore signing. Free CLI; policy engines are separate.

    CatchSigning CLI + public-good Sigstore infra — not a full policy admission controller (pair with Kyverno/OPA). Offline/air-gap needs different PKI. Registry must support referrers/OCI artifacts cleanly.

  3. 3.GitleaksMIT secret scanner for git/dirs/stdin; CLI free, org Action needs free key

    Free / OSS · OSS/MIT · 30.1k GitHub stars

    VerdictMIT secrets CLI. Free forever; org Action wants free license key.

    CatchMaintainer marks feature-complete (security patches; focus shifting to Betterleaks). Official Action for GitHub org repos needs a free license key from gitleaks.io — personal accounts exempt. Not a full ASVS/SAST suite. False positives need allowlists.

  4. 4.GrypeApache-2.0 SBOM-first vulnerability scanner from Anchore; free CLI

    Free / OSS · Apache-2.0 · 13k GitHub stars

    VerdictApache-2.0 SBOM vuln scanner. Free CLI; Enterprise is the paid cousin.

    CatchVuln scanner — not Trivy's IaC/secrets swiss-army, not Cosign signing, not Anchore Enterprise governance UI. You still triage CVEs. Anchore monetizes Enterprise separately.

  5. 5.AnubisMIT PoW challenge layer vs AI scrapers in front of Caddy/Traefik

    Free / OSS · OSS/MIT · 23.5k GitHub stars

    VerdictMIT anti-scraper PoW layer. Free forever; tune policies.

    CatchPoW slows mass scrapers; determined headless solvers still pass. Can impede Archive/RSS unless you allowlist. Not Cloudflare WAF. Distinct from Traefik/Caddy proxies.

  6. 6.direnvMIT per-directory env loader for any shell

    Free / OSS · OSS/MIT · 15.5k GitHub stars

    VerdictMIT directory env. Free forever; allow once per project and stop polluting $PATH.

    CatchEach new .envrc needs `direnv allow`. Not a secrets vault — still files on disk.

  7. 7.ageBSD-3 simple file encryption by FiloSottile

    Free / OSS · BSD-3-Clause · 24k GitHub stars

    VerdictBSD-3 file encryption. Free forever; pair with SOPS when the team outgrows ad-hoc scripts.

    CatchNot a password manager or key directory. You still distribute public keys yourself.

  8. 8.AtuinMIT magical shell history with optional E2E sync

    Free / OSS · OSS/MIT · 32k GitHub stars

    VerdictMIT shell history. Free forever CLI + self-host sync; hosted sync stays optional.

    CatchShell history tool — not a prompt (Starship), not a jumper (zoxide), not Dotfiles sync. Desktop/Hub team features are a separate product line (Hub not self-hostable). Atuin AI is free while in testing — treat that as temporary.

FAQ

What are the best free alternatives to Ghidra?
Trivy, Cosign, Gitleaks, Grype, Anubis. All are reviewed on Stack Gems in the same category (security tools); 8 free or open source.
What is the catch with Ghidra?
A heavy Java desktop app — the 12.1 release needs a 64-bit JDK 21, and Python 3 for the debugger and PyGhidra.
Is there an open-source alternative to Ghidra?
Yes: Trivy (Apache-2.0), Cosign (Apache-2.0), Gitleaks (OSS/MIT), Grype (Apache-2.0).

More