Choosing a security scanning tool means matching its coverage to the systems and workflows that need protection while checking whether the project is healthy and actively shipping. This October 2026 snapshot uses the supplied ToolVitals records to compare open/source-visible tools by score, health, shipping, license, and stated focus.
The ranking uses ToolVitals score first, with health and shipping used to order equal composite scores. GitHub stars are context only and do not determine the order.
Rankings
| Rank | Tool | Openness | License | Health | Shipping | GitHub Stars | Score | Status |
|---|---|---|---|---|---|---|---|---|
| 1 | Akto | OSI-approved OSS | MIT | 98 | 98 | 1528 | 98 | 🟢 Excellent |
| 2 | DefectDojo | OSI-approved OSS | BSD-3-Clause | 97 | 97 | 4990 | 97 | 🟢 Excellent |
| 3 | Prowler | OSI-approved OSS | Apache-2.0 | 97 | 96 | 14989 | 96 | 🟢 Excellent |
| 4 | Snyk | OSI-approved OSS | Apache-2.0 | 97 | 96 | 5672 | 96 | 🟢 Excellent |
| 5 | Kubescape | OSI-approved OSS | Apache-2.0 | 97 | 95 | 11786 | 96 | 🟢 Excellent |
| 6 | Strix | OSI-approved OSS | Apache-2.0 | 96 | 95 | 67414 | 96 | 🟢 Excellent |
| 7 | MegaLinter | OSI-approved OSS | AGPL-3.0 | 96 | 95 | 2611 | 95 | 🟢 Excellent |
| 8 | OSV.dev | OSI-approved OSS | Apache-2.0 | 96 | 95 | 2964 | 95 | 🟢 Excellent |
| 9 | OWASP Noir | OSI-approved OSS | MIT | 96 | 95 | 1451 | 95 | 🟢 Excellent |
| 10 | Nuclei | OSI-approved OSS | MIT | 96 | 94 | 31838 | 95 | 🟢 Excellent |
| 11 | Prosopo CAPTCHA | OSI-approved OSS | Apache-2.0 | 95 | 96 | 301 | 95 | 🟢 Excellent |
| 12 | Dalfox | OSI-approved OSS | MIT | 95 | 94 | 5320 | 95 | 🟢 Excellent |
| 13 | Trivy | OSI-approved OSS | Apache-2.0 | 95 | 93 | 38310 | 95 | 🟢 Excellent |
| 14 | lopper | OSI-approved OSS | MIT | 93 | 95 | 2 | 94 | 🟢 Excellent |
| 15 | Web-Check | OSI-approved OSS | MIT | 92 | 91 | 35058 | 92 | 🟢 Excellent |
| 16 | FoxGuard | OSI-approved OSS | MIT | 90 | 91 | 304 | 90 | 🟢 Excellent |
| 17 | OpenA2A | OSI-approved OSS | Apache-2.0 | 90 | 90 | 21 | 90 | 🟢 Excellent |
| 18 | sqlmap | OSI-approved OSS | GPL-2.0 | 88 | 92 | 38637 | 90 | 🟢 Excellent |
| 19 | Presidio | OSI-approved OSS | MIT | 91 | 85 | 11244 | 89 | 🟢 Excellent |
| 20 | Faraday | OSI-approved OSS | GPL-3.0 | 90 | 86 | 6773 | 88 | 🟢 Excellent |
| 21 | OpenAnt | OSI-approved OSS | Apache-2.0 | 89 | 85 | 757 | 88 | 🟢 Excellent |
| 22 | powerpipe | OSI-approved OSS | AGPL-3.0 | 86 | 86 | 523 | 86 | 🟢 Excellent |
| 23 | Nettacker | OSI-approved OSS | Apache-2.0 | 87 | 78 | 5648 | 83 | 🟢 Excellent |
| 24 | Pentagi | OSI-approved OSS | MIT | 86 | 78 | 25372 | 83 | 🟢 Excellent |
| 25 | Steampipe | OSI-approved OSS | AGPL-3.0 | 85 | 79 | 7977 | 82 | 🟢 Excellent |
| 26 | Copacetic | OSI-approved OSS | Apache-2.0 | 84 | 73 | 1725 | 79 | 🟢 Good |
| 27 | Lynis | OSI-approved OSS | GPL-3.0 | 80 | 76 | 16443 | 78 | 🟢 Good |
| 28 | Pentest AI | OSI-approved OSS | MIT | 74 | 67 | 1729 | 71 | 🟢 Good |
| 29 | Xingrin | OSI-approved OSS | MIT | 55 | 34 | 658 | 46 | 🟡 Fair |
| 30 | vulnerability-spoiler-alert | OSI-approved OSS | MIT | 50 | 36 | 161 | 44 | 🟡 Fair |
| 31 | PayloadsAllTheThings | OSI-approved OSS | MIT | 50 | 27 | 81573 | 41 | 🟡 Fair |
| 32 | ExtensionShield | OSI-approved OSS | MIT | 45 | 35 | 105 | 41 | 🟡 Fair |
| 33 | Gitleaks | OSI-approved OSS | MIT | 50 | 20 | 29810 | 38 | 🔴 Needs Attention |
| 34 | NodeJSSCAN | OSI-approved OSS | GPL-3.0 | 43 | 17 | 2576 | 33 | 🔴 Needs Attention |
| 35 | Dokuru | OSI-approved OSS | Apache-2.0 | 34 | 17 | 8 | 27 | 🔴 Needs Attention |
| 36 | AgentFence | OSI-approved OSS | MIT | 33 | 13 | 61 | 25 | 🔴 Needs Attention |
| 37 | Redlyne | OSI-approved OSS | Apache-2.0 | 31 | 14 | 39 | 24 | 🔴 Needs Attention |
| 38 | CloudRec | OSI-approved OSS | Apache-2.0 | 17 | 4 | 191 | 12 | 🔴 Needs Attention |
| 39 | Lodestar Forge | OSI-approved OSS | GPL-3.0 | 19 | 0 | 110 | 11 | 🔴 Needs Attention |
| 40 | Deepfence ThreatMapper | OSI-approved OSS | Apache-2.0 | 15 | 2 | 5324 | 10 | 🔴 Needs Attention |
| 41 | Agentic Radar | OSI-approved OSS | Apache-2.0 | 4 | 0 | 1056 | 2 | 🔴 Needs Attention |
| 42 | CodeAnalysis | OSI-approved OSS | GPL-2.0 | 3 | 0 | 1849 | 2 | 🔴 Needs Attention |
| 43 | Metlo | OSI-approved OSS | MIT | 1 | 0 | 1788 | 1 | 🔴 Needs Attention |
| 44 | OpenClarity | OSI-approved OSS | Apache-2.0 | 0 | 0 | 1460 | 0 | 🔴 Needs Attention |
| 45 | VMC | OSI-approved OSS | Apache-2.0 | 0 | 0 | 93 | 0 | 🔴 Needs Attention |
Top 3 Highlights
Akto ranks first with a ToolVitals score of 98, alongside health and shipping scores of 98. Its supplied description focuses on API discovery, security posture, and CI/CD testing, making it a direct fit for API-centered scanning programs. ToolVitals lists it as OSI-approved OSS with an MIT license.
DefectDojo ranks second with a ToolVitals score of 97 and health and shipping scores of 97. Its supplied description covers unified vulnerability management, DevSecOps, and ASPM, making it relevant for teams that need to manage security findings across development and operations. ToolVitals lists it as OSI-approved OSS with a BSD-3-Clause license.
Prowler ranks third with a ToolVitals score of 96, a health score of 97, and a shipping score of 96. Its supplied description focuses on cloud security and automating security and compliance across cloud environments, making it relevant for cloud-focused scanning programs. ToolVitals lists it as OSI-approved OSS with an Apache-2.0 license.
Want to see the full health, license, shipping, and confidence details for every tool in Security Scanning? Browse all Security Scanning Tools →