# OSV-Scanner

> Apache-2.0 OSV.dev vulnerability scanner for lockfiles and images

**Category:** DevOps  
**Pricing:** open-source  
**URL:** https://google.github.io/osv-scanner/  
**GitHub:** https://github.com/google/osv-scanner  
**Added:** 2026-09-13

---

## The Hook

OSV-Scanner is Google’s CLI onto OSV.dev when you want lockfile/SBOM/image vulns from an open database, not a closed advisory feed.

## What's Good

Apache-2.0. google/osv-scanner. Official frontend to OSV.dev (+ OSV-Scalibr): scan source, lockfiles, SBOMs, and container images; offline DB mode; license scan path. Docs at google.github.io/osv-scanner; source github.com/google/osv-scanner. Slug is `osv-scanner`.

## The Catch

Vs Trivy/Grype (broader/image-first scanners) and Syft (*SBOM producer*): OSV-Scanner is the OSV.dev-native vuln CLI, not a replacement for every Trivy filesystem/misconfig check and not the SBOM generator. Complements those tools; do not expect identical CVE sets. Networked API unless you go `--offline`.

## Verdict

Apache-2.0 OSV.dev scanner. Free forever; pair with Trivy/Grype/Syft, do not clone them.