---
name: OSV-Scanner
slug: osv-scanner
url: https://google.github.io/osv-scanner/
category: Dependencies
bestFor: "Match a project's lockfiles to known vulnerabilities in the OSV database, including npm."
freeTier: yes
price: "Apache-2.0"
checks: []
freeTierNote: "The docs describe a CLI and a Go library and do not list a paid plan. The repository LICENSE file is Apache License 2.0, which grants a no-charge copyright license. The README on the GitHub repository says a source scan recursively reads supported package files such as package.json, go.mod, and pom.xml, and that no source code is sent to OSV.dev or deps.dev."
verifiedOn: "2026-10-14"
sources:
  - https://google.github.io/osv-scanner/
  - https://github.com/google/osv-scanner
  - https://raw.githubusercontent.com/google/osv-scanner/main/LICENSE
unknowns:
  - "A dollar price. The docs and the license do not list one."
  - "Whether call analysis, guided remediation, or container scanning is on by default for an npm project. The README marks guided remediation experimental."
---

OSV-Scanner connects the dependencies in a project to vulnerabilities in the OSV database. The README's source command scans a directory for package files. It is a dependency check, not a test of authentication or row level security.

The docs do not sell a hosted tier. The license in the repository is Apache-2.0. Data sent to OSV.dev is package names, versions, ecosystems, and file hashes. Use the offline mode described in the README if you do not want that call.

Read the advisory before you upgrade. A clean scan does not mean the app checks who can read a row.