Software composition analysis
Asked as “software composition analysis tool”, and as “open source dependency vulnerability scanner”, on behalf of a mid-market B2B company. 51 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each.
Standing · first-choice share
31%
Contested · Snyk Open Source 16%
31Trivy16Snyk Open Source14Mend.io39others
31% of first choices, contested.
Since September 2026▼−5Since September 2026: 40% → 34%, −5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Trivy held the lead, −5 points on 40%, inside the 11-point floor.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small business
Snyk Open Source39%Contested↗new leaderNew leader since September 2026: Snyk Open Source (41%) replaces Trivy (36% then, 15% now), 26 points clear, past the 11-point floor.Standing →Mid-market
Trivy31%Contested▼−5Since September 2026: 40% → 34%, −5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.This pageEnterprise
Black Duck23%Contested↗new leaderNew leader since September 2026: Sonatype Lifecycle (22%) replaces Black Duck (19% then, 22% now), 0 points clear, inside the 11-point floor.Standing →
Snyk Open Source39%Contested↗new leaderNew leader since September 2026: Snyk Open Source (41%) replaces Trivy (36% then, 15% now), 26 points clear, past the 11-point floor.Standing →Mid-marketTrivy31%Contested▼−5Since September 2026: 40% → 34%, −5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.This pageEnterpriseBlack Duck23%Contested↗new leaderNew leader since September 2026: Sonatype Lifecycle (22%) replaces Black Duck (19% then, 22% now), 0 points clear, inside the 11-point floor.Standing →The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for a mid-market B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrantSince September 2026
01Trivy31%11%27endorsed leader▼−5Since September 2026: 40% → 34%, −5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.40% → 34%
Trivy31%11%27endorsed leader▼−5Since September 2026: 40% → 34%, −5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.40% → 34%02Snyk Open Source16%16%55accepted challenger=heldSince September 2026: 16% → 16%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.16% → 16%
Snyk Open Source16%16%55accepted challenger=heldSince September 2026: 16% → 16%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.16% → 16%03
Mend.io14%19%37accepted challenger=heldSince September 2026: 14% → 14%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.14% → 14%
Mend.io14%19%37accepted challenger=heldSince September 2026: 14% → 14%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.14% → 14%04
OWASP Dependency-Track8%0%21accepted challenger▲+4Since September 2026: 2% → 7%, +4 points. Inside the 11-point floor: within noise. Read over the models both editions asked.2% → 7%
OWASP Dependency-Track8%0%21accepted challenger▲+4Since September 2026: 2% → 7%, +4 points. Inside the 11-point floor: within noise. Read over the models both editions asked.2% → 7%05
OWASP Dependency-Check8%23%35accepted challenger▼−5Since September 2026: 14% → 9%, −5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.14% → 9%
OWASP Dependency-Check8%23%35accepted challenger▼−5Since September 2026: 14% → 9%, −5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.14% → 9%06
GitHub Dependabot8%18%17accepted challenger=heldSince September 2026: 5% → 5%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.5% → 5%
GitHub Dependabot8%18%17accepted challenger=heldSince September 2026: 5% → 5%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.5% → 5%07
Sonatype Lifecycle2%9%32accepted challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%
Sonatype Lifecycle2%9%32accepted challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%08
GitHub Advanced Security2%6%18accepted challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%
GitHub Advanced Security2%6%18accepted challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%09
OSV-Scanner2%0%12accepted challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%
OSV-Scanner2%0%12accepted challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%10
Socket2%0%12accepted challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%
Socket2%0%12accepted challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%Show the seven products at 0%, ordered by negative rate
14Black Duck0%32%38criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Black Duck0%32%38criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%17
Checkmarx SCA0%20%15accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Checkmarx SCA0%20%15accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%15
JFrog Xray0%8%13accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
JFrog Xray0%8%13accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%13
FOSSA0%5%19accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
FOSSA0%5%19accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%11Grype0%0%16accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
12
Endor Labs0%0%14accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Endor Labs0%0%14accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%16Syft0%0%10accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one is noise, and both are shown. Movement is read over the twelve models both editions asked; GPT-6 Luna, Muse Glimmer 30B joined this edition and are in the standing but not yet in the comparison. How the floor is measured
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
All twenty-eight head-to-head pages: the top eight products, each against each
Trivy vs OWASP Dependency-CheckTrivy vs GitHub DependabotTrivy vs Sonatype LifecycleTrivy vs GitHub Advanced SecuritySnyk Open Source vs Mend.ioSnyk Open Source vs OWASP Dependency-TrackSnyk Open Source vs OWASP Dependency-CheckSnyk Open Source vs GitHub DependabotSnyk Open Source vs Sonatype LifecycleSnyk Open Source vs GitHub Advanced SecurityMend.io vs OWASP Dependency-TrackMend.io vs OWASP Dependency-CheckMend.io vs GitHub DependabotMend.io vs Sonatype LifecycleMend.io vs GitHub Advanced SecurityOWASP Dependency-Track vs OWASP Dependency-CheckOWASP Dependency-Track vs GitHub DependabotOWASP Dependency-Track vs Sonatype LifecycleOWASP Dependency-Track vs GitHub Advanced SecurityOWASP Dependency-Check vs GitHub DependabotOWASP Dependency-Check vs Sonatype LifecycleOWASP Dependency-Check vs GitHub Advanced SecurityGitHub Dependabot vs Sonatype LifecycleGitHub Dependabot vs GitHub Advanced SecuritySonatype Lifecycle vs GitHub Advanced Security
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
01020304050607080910G11
12131415S16
17Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative50%
Key
01Trivy31%
Trivy31%02Snyk Open Source16%
Snyk Open Source16%03Mend.io14%
Mend.io14%04OWASP Dependency-Track8%
OWASP Dependency-Track8%05OWASP Dependency-Check8%
OWASP Dependency-Check8%06GitHub Dependabot8%
GitHub Dependabot8%07Sonatype Lifecycle2%
Sonatype Lifecycle2%08GitHub Advanced Security2%
GitHub Advanced Security2%09OSV-Scanner2%
OSV-Scanner2%10Socket2%
Socket2%11Grype0%
12Endor Labs0%
Endor Labs0%13FOSSA0%
FOSSA0%14Black Duck0%
Black Duck0%15JFrog Xray0%
JFrog Xray0%16Syft0%
17Checkmarx SCA0%
Checkmarx SCA0%What they warned about
Zero of fourteen models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Grok 4.1 Fast, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX, MiniMax M2.5, GPT-6 Luna and Muse Glimmer 30B changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Snyk Open Source16%
9 of 55 labels negative · 8 of 14 models
“enterprise buyers often cite "unpredictable ballooning costs"... some procurement models recommend avoiding it if strict cost-prediction budgets are required” Qwen 3.7 Flash, negative prompt
Black Duck32%
12 of 38 labels negative · 7 of 14 models · 1 hard negative
“Tools/Approaches to Be Cautious About ... Black Duck (Synopsys) ... Slow scanning ... Complicated pricing” Kimi K2, negative prompt
Mend.io19%
7 of 37 labels negative · 6 of 14 models · 1 hard negative
“This is the tool that surfaces most frequently in negative developer feedback” DeepSeek V4 Flash, negative prompt
OWASP Dependency-Check23%
8 of 35 labels negative · 6 of 14 models
“useful as a free scanner, but I'd avoid treating its results as definitive ... can produce both false positives and false negatives” GPT-6 Luna, negative prompt
What they cite
Citations exist only for the models that return a source list: fourteen of the fourteen in this edition, and all six flagship models on the expanded tier.
Sites the answers cite
79 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 1073 links across 228 sites, every framing counted. Ranked by the number of answers carrying the site or page. 3 of the 252 answers across every segment cited this index's own page for the category; the method page measures whether that reading tilts an answer.
vendor site · Guideflow42 answers · 44 citations · 11 models
vendor site · Sonatype34 answers · 48 citations · 12 models
vendor site · Endor Labs32 answers · 45 citations · 12 models
vendor site · Mend28 answers · 34 citations · 14 models
vendor site · Checkmarx28 answers · 30 citations · 11 models
vendor site · Safeguard27 answers · 43 citations · 10 models
25 answers · 25 citations · 10 models
24 answers · 32 citations · 10 models
23 answers · 23 citations · 10 models
vendor site · G218 answers · 29 citations · 9 models
vendor site · Aikido18 answers · 21 citations · 9 models
vendor site · OX18 answers · 18 citations · 9 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
38 answers · 11 models
33 answers · 11 models
28 answers · 12 models
25 answers · 10 models
24 answers · 10 models
23 answers · 10 models
18 answers · 9 models
18 answers · 7 models
16 answers · 11 models
14 answers · 8 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best software composition analysis tool”, “software composition analysis tool”, “software composition analysis tools”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days | Best Google position |
|---|---|---|---|---|---|---|---|---|
| Trivy trivy.dev | 31% | 207 | 5,400 | 182 | 3,093 | |||
| Snyk snyk.io Snyk Open Source 16% | 16% | 172 | 12,100 | 581 | 61,651 company | 60 | ||
| OWASP Dependency-Track owasp.org OWASP Dependency-Track 8%, OWASP Dependency-Check 8% | 16% | 95 | 720 | 10 | 365,222 | 3 | ||
| Mend.io mend.io | 14% | 114 | 210 | 11 | 15,059 | 7 | ||
| GitHub parent site GitHub Dependabot 8%, GitHub Advanced Security 2% | 10% | 111 | 1,500,000 | 31,479 | ||||
| Sonatype sonatype.com Sonatype Lifecycle 2% | 2% | 121 | 90 | 1 | 71,814 company | $1,879 | 7 | 8 |
| OSV-Scanner osv.dev | 2% | 31 | 390 | 22 | 749 | |||
| Socket socket.dev | 2% | 33 | 60,500 | 95,979 | 16,465 | 1 | ||
| Semgrep semgrep.dev Semgrep 2%, Semgrep Supply Chain 0% | 2% | 194 | 8,100 | 191 | 3,461 | 43 | ||
| Aikido aikido.dev Aikido Security 2% | 2% | 342 | 2,400 | 51 | 6,442 company | $936 | 120 |
Google's top ten for the three searches hold 22 sites; 3 of them are among the sites the models cited here (endorlabs.com, ox.security, sonatype.com). The first result for “best software composition analysis tool” is endorlabs.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best software composition analysis tool for a mid-market B2B company?”Paraphrase“Which open source dependency vulnerability scanner would you recommend to a mid-sized B2B company?”Comparative“What are the top software composition analysis tools and how do they differ?”Budget-constrained“What is the best software composition analysis tool for a company with a limited budget?”Scale-constrained“We are a 500 person company evaluating a software composition analysis tool. What should we look at?”Negative“Which software composition analysis tools should I avoid or be cautious about?”
Claude Haiku 4.5Mend.ioTrivyChangedSnyk Open SourceOWASP Dependency-Checkno first choiceagainst: Aikido Security, Black Duck Software Composition Analysis, Checkmarx SCA, FOSSA, Mend.io, Snyk Open Source
Five alternatives
Black Duck, Endor Labs, FOSSA, Snyk Open Source, Sonatype LifecycleTwo alternatives
OSV-Scanner, OWASP Dependency-CheckFour alternatives
Black Duck, FOSSA, JFrog Xray, Mend.ioFour alternatives
Grype, OSS Review Toolkit, OSV-Scanner, Snyk Open SourceGPT-5.4 miniSnyk Open Sourceagainst: Black DuckOWASP Dependency-TrackChangedno first choiceOWASP Dependency-Checkno first choicenothing named
Three alternatives
FOSSA, OWASP Dependency-Check, OWASP Dependency-TrackTwo alternatives
OWASP Dependency-Check, TrivyOne alternative
OWASP Dependency-TrackGemini 3.5 FlashAikido Securityagainst: Black Duck, GitHub Advanced Security, Veracode SCATrivyChangedagainst: Black Duck, Snyk Open SourceSnyk Open SourceGitHub Dependabotagainst: Black Duck, Mend.io, Sonatype Lifecycleno first choiceagainst: Black Duck, Mend.io, OWASP Dependency-Check, Snyk Open Source
Three alternatives
Endor Labs, Mend.io, Snyk Open SourceThree alternatives
Grype + Syft, OSV-Scanner, OWASP Dependency-TrackSix alternatives
Black Duck, Endor Labs, GitHub Dependabot, Mend.io, Socket, TrivySeven alternatives
Aikido Security, Grype, OWASP Dependency-Check, OWASP Dependency-Track, Snyk Open Source, Syft, TrivyPerplexity SonarMend.ioTrivyChangedSemgrep Supply Chain, Snyk Open SourceOWASP Dependency-Checkagainst: Black Duck, Mend.io, Veracode SCAno first choiceagainst: GitHub Dependabot, OWASP Dependency-Check
Three alternatives
Black Duck, Snyk Open Source, Sonatype LifecycleTwo alternatives
OSV-Scanner, OWASP Dependency-CheckSeven alternatives
Black Duck, Checkmarx SCA, FOSSA, Grype, Mend.io, OWASP Dependency-Check, Sonatype LifecycleFour alternatives
FOSSA, GitHub Advanced Security, GitHub Dependabot, Snyk Open SourceGrok 4.1 FastSnyk Open Sourceagainst: Black DuckTrivyChangedBlack Duck, Snyk Open Source, Sonatype LifecycleTrivyagainst: OWASP Dependency-Checkno first choiceagainst: Black Duck, Checkmarx SCA, GitHub Dependabot, GitLab Dependency Scanning, JFrog Xray, Mend.io, OWASP Dependency-Check, Semgrep Supply Chain, Snyk Open Source, Sonatype Lifecycle, Trivy, Veracode SCA
Two alternatives
Mend.io, Sonatype LifecycleThree alternatives
Grype, OSV-Scanner, OWASP Dependency-CheckFour alternatives
GitHub Advanced Security, Mend.io, SonarQube, Veracode SCAThree alternatives
GitHub Advanced Security, OWASP Dependency-Track, Snyk Open SourceMistral SmallMend.ioOSV-ScannerChangedno first choiceOWASP Dependency-Track, Scanmycode.iono first choicenothing named
Two alternatives
GitHub Advanced Security, Insignary ClarityTwo alternatives
Grype, OWASP Dependency-CheckTwo alternatives
Code Insight, Qwiet AIDeepSeek V4 FlashSnyk Open SourceOWASP Dependency-Track, TrivyChangedno first choiceTrivyno first choiceagainst: Mend.io
Two alternatives
Mend.io, Sonatype LifecycleTwo alternatives
Grype, OSV-ScannerTen alternatives
Black Duck, Checkmarx SCA, Endor Labs, FOSSA, GitHub Advanced Security, GitHub Dependabot, JFrog Xray, Mend.io, Snyk Open Source, Sonatype LifecycleFour alternatives
Grype, OWASP Dependency-Check, OWASP Dependency-Track, Snyk Open SourceLlama 4 MaverickMend.iono first choiceChangedno first choiceSemgrep, Socket, Trivyno first choicenothing named
Two alternatives
OWASP Dependency-Check, Snyk Open SourceQwen 3.7 FlashMend.ioagainst: Sonatype LifecycleTrivyChangedagainst: OWASP Dependency-Check, go mod tidy, npm audit, pip checkno first choiceTrivyagainst: OWASP Dependency-CheckSnyk Open Sourceagainst: Black Duck, Snyk Open Source, npm audit
Two alternatives
GitHub Advanced Security, Snyk Open SourceTwo alternatives
OSV-Scanner, RenovateSix alternatives
Black Duck, JFrog Xray, Mend.io, OWASP Dependency-Track, Snyk Open Source, Sonatype LifecycleThree alternatives
Aikido Security, Semgrep, Snyk Open SourceFour alternatives
Black Duck, JFrog Xray, Mend.io, Sonatype LifecycleKimi K2Mend.io, Snyk Open Sourceagainst: Black Duck, Checkmarx SCATrivyChangedagainst: Snyk Open SourceSnyk Open SourceTrivyagainst: OWASP Dependency-Checkno first choiceagainst: Black Duck
Four alternatives
GitHub Advanced Security, GitHub Dependabot, Sonatype Lifecycle, TrivyThree alternatives
Grype, OWASP Dependency-Check, SyftSix alternatives
Black Duck, Checkmarx SCA, Endor Labs, FOSSA, Mend.io, Sonatype LifecycleTwo alternatives
GitHub Dependabot, Grype + SyftGLM 4.7 FlashXGitHub Advanced Security, Snyk Open SourceTrivyChangedagainst: Snyk Open SourceSnyk Open SourceGitHub Dependabot, Trivyno first choicenothing named
Five alternatives
Black Duck, Endor Labs, FOSSA, Mend.io, Sonatype LifecycleTwo alternatives
OWASP Dependency-Check, OWASP Dependency-TrackFour alternatives
Black Duck, Checkmarx SCA, Sonatype Lifecycle, Synopsys Software Integrity PlatformFour alternatives
Grype, OWASP Dependency-Check, OWASP Dependency-Track, SyftMiniMax M2.5Snyk Open Source, Sonatype LifecycleOWASP Dependency-CheckChangedSonatype Lifecycleagainst: Mend.ioTrivyno first choiceagainst: Black Duck, Snyk Open Source
Three alternatives
Black Duck, FOSSA, GitHub Advanced SecurityThree alternatives
Grype, OWASP Dependency-Track, SyftThree alternatives
Black Duck, Endor Labs, Snyk Open SourceThree alternatives
Semgrep, Snyk Open Source, SocketGPT-6 LunaSnyk Open SourceGoogle's OSV-ScannerChangedagainst: Trivyno first choiceGitHub Dependabotno first choiceagainst: GitHub Dependabot, OWASP Dependency-Check
Three alternatives
GitHub's built-in supply-chain tools, Mend.io, Sonatype LifecycleTwo alternatives
Grype, OWASP Dependency-TrackEight alternatives
Black Duck, FOSSA, GitHub Dependabot, JFrog Xray, Mend.io, OWASP Dependency-Track, Snyk Open Source, Sonatype LifecycleTwo alternatives
OWASP Dependency-Track, TrivyMuse Glimmer 30BMend.ioTrivyChangedSnyk Open SourceGitHub Dependabot, OWASP Dependency-Trackagainst: Snyk Open Sourceno first choiceagainst: Cloudsmith, JFrog, Trivy
Two alternatives
Snyk Open Source, Sonatype LifecycleThree alternatives
Grype, OWASP Dependency-Check, SyftFour alternatives
Black Duck, Endor Labs, FOSSA, Mend.ioThree alternatives
Semgrep, Socket, TrivyBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Eighty-four rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 12:25 | yes | 17 | 8 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 13:41 | yes | 3 | 5 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 09:22 | yes | 17 | 24 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-10-01 11:36 | yes | 17 | 3 s |
| Direct recommendation | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 10:02 | yes | 21 | 7 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 12:57 | yes | 5 | 3 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 11:23 | yes | 20 | 28 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 12:31 | yes | 5 | 1 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 12:14 | yes | 9 | 35 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 11:00 | yes | 18 | 18 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 09:55 | yes | 22 | 133 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 12:46 | yes | 5 | 22 s |
| Direct recommendation | GPT-6 Luna | gpt-6-luna | 2026-10-01 08:24 | yes | 4 | 18 s |
| Direct recommendation | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 10:26 | yes | 21 | 30 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 13:12 | yes | 9 | 8 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 10:12 | yes | 3 | 6 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 10:09 | yes | 10 | 21 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-10-01 13:19 | yes | 25 | 4 s |
| Paraphrase | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 09:36 | yes | 22 | 13 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 12:25 | yes | 5 | 3 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 10:26 | yes | 23 | 33 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 11:19 | yes | 5 | 2 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 10:42 | no | 0 | 28 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 11:24 | yes | 14 | 18 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 09:23 | yes | 25 | 114 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 10:46 | yes | 14 | 32 s |
| Paraphrase | GPT-6 Luna | gpt-6-luna | 2026-10-01 13:02 | yes | 4 | 28 s |
| Paraphrase | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 08:36 | yes | 13 | 25 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 10:46 | yes | 15 | 9 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 13:36 | yes | 4 | 11 s |
| Comparative | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 12:47 | yes | 16 | 25 s |
| Comparative | Perplexity Sonar | sonar | 2026-10-01 13:01 | yes | 17 | 7 s |
| Comparative | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 11:45 | yes | 21 | 9 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 11:31 | yes | 17 | 11 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 08:41 | yes | 22 | 38 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 07:44 | yes | 5 | 1 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 11:57 | yes | 24 | 184 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 07:40 | yes | 19 | 22 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 10:40 | yes | 24 | 47 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 12:49 | yes | 9 | 18 s |
| Comparative | GPT-6 Luna | gpt-6-luna | 2026-10-01 08:52 | yes | 8 | 25 s |
| Comparative | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 09:57 | yes | 14 | 36 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 07:48 | yes | 10 | 8 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 08:08 | yes | 3 | 68 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 10:45 | yes | 10 | 24 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-10-01 13:32 | yes | 18 | 3 s |
| Budget constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 10:08 | yes | 19 | 8 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 09:02 | yes | 5 | 3 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 12:54 | yes | 16 | 29 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 09:00 | yes | 6 | 5 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 12:25 | yes | 14 | 37 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 13:16 | yes | 10 | 28 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 08:55 | yes | 20 | 29 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 09:24 | yes | 14 | 22 s |
| Budget constrained | GPT-6 Luna | gpt-6-luna | 2026-10-01 12:23 | yes | 3 | 16 s |
| Budget constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 09:53 | yes | 14 | 19 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 07:49 | no | 0 | 8 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 11:19 | no | 0 | 8 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 09:38 | yes | 9 | 21 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-10-01 12:12 | yes | 16 | 5 s |
| Scale constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 08:09 | yes | 16 | 8 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 11:03 | no | 0 | 9 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 12:10 | yes | 19 | 53 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 11:10 | yes | 5 | 2 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 07:38 | yes | 5 | 21 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 08:07 | yes | 15 | 20 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 07:27 | yes | 15 | 22 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 13:48 | no | 0 | 11 s |
| Scale constrained | GPT-6 Luna | gpt-6-luna | 2026-10-01 11:08 | yes | 3 | 19 s |
| Scale constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 10:32 | yes | 13 | 27 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 12:42 | yes | 17 | 12 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 10:53 | yes | 5 | 5 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 09:34 | yes | 19 | 19 s |
| Negative framing | Perplexity Sonar | sonar | 2026-10-01 10:10 | yes | 19 | 5 s |
| Negative framing | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 09:27 | yes | 22 | 14 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 07:56 | yes | 5 | 3 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 13:53 | yes | 25 | 42 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 09:12 | yes | 5 | 1 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 08:59 | yes | 12 | 71 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 10:35 | yes | 23 | 21 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 11:19 | yes | 22 | 48 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 10:22 | yes | 23 | 29 s |
| Negative framing | GPT-6 Luna | gpt-6-luna | 2026-10-01 10:37 | yes | 3 | 23 s |
| Negative framing | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 12:39 | yes | 24 | 24 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
Aikido read as Aikido Security
Checkmarx read as Checkmarx SCA
GitLab read as GitLab Dependency Scanning
GitLab Ultimate read as GitLab Dependency Scanning
Mend read as Mend.io
Mend (WhiteSource) read as Mend.io
Mend (formerly Checkmarx One) read as Mend.io
Mend (formerly Snyk, now Mend.io) read as Mend.io
Mend (formerly WhiteSource) read as Mend.io
Snyk read as Snyk Open Source
Snyk (Free tier) read as Snyk Open Source
Snyk Free Tier read as Snyk Open Source
Snyk Team read as Snyk Open Source
Sonatype read as Sonatype Lifecycle
Sonatype (Lifecycle/Sonatype SBOM Manager) read as Sonatype Lifecycle
Veracode read as Veracode SCA
Unresolved, counted raw
Anchore Open Source Dependency Scanner
Black Duck Software Composition Analysis
Code Insight
EndorLabs
GitHub's built-in supply-chain tools
Google's OSV-Scanner
OWASP's Dependency-Track
OpenSSF Scorecard
Qwiet AI
Scanmycode.io
Synopsys Software Integrity Platform
go mod tidy
pip check
Discontinued, still offered
No shut-down product was recommended here.