By Rushabh Shah, Senior Software Developer · 2026-09-07
Anchore's open-source tools, Syft (SBOM generation) and Grype (vulnerability scanning), are genuinely free and genuinely good — Anchore built and still sponsors both. The commercial product, Anchore Enterprise, solves a different problem: centrally storing, tracking and monitoring thousands of SBOMs across an organization's full software lifecycle, with FedRAMP and DoD Software Factory compliance built in. That's real infrastructure for a container-heavy, compliance-driven org — but it means installing tools locally (or standing up the Enterprise platform) rather than just checking one project right now.
DepWarden is a free, anonymous alternative for that immediate check — nothing to install, no SBOM store to stand up. Paste a manifest, a lockfile, or an SBOM — or point it at a public repo — and get results in seconds, in a private, session-isolated workspace. No account, no local tooling, and it never receives your source code or container images — only the dependency manifest text.
Every component is checked against the full OSV mirror, then enriched with CISA KEV (actively exploited) and FIRST EPSS (exploit probability) — a short "fix these first" list instead of a raw CVE count, free on every scan.
To be fair: Anchore's container-image-native scanning (walking actual image layers, not just a manifest) and its centralized SBOM store for tracking compliance across thousands of artifacts over time are real, specialized capabilities — particularly for FedRAMP/DoD environments with hard SBOM-retention requirements. DepWarden works from manifests and lockfiles, not built container images, and doesn't attempt to be a long-term SBOM archive.
Typosquat and dependency-confusion detection, OpenSSF Scorecard health, deprecated and end-of-life packages, plus a full compliance round-trip — ingest an existing CycloneDX or SPDX SBOM (including one Syft already generated), export a CycloneDX SBOM, an OpenVEX document, and a NOTICE / license-obligations file.
Connect a GitHub, GitLab, Bitbucket or Azure DevOps repo branch with a personal access token and attach a schedule — daily, weekly or monthly — and DepWarden re-scans it automatically and emails a report. No token retained beyond the scan.
Try it: paste an existing Syft-generated SBOM, or a package-lock.json/pom.xml, and see prioritized findings in seconds — no sign-up, nothing to install.