# OSV-Scanner: how AI models rank it, November 2026

Gane Index, November 2026 Edition. Named in 14 judge labels across 1 category by 7 of 14 models. Page: https://www.gane.ai/index/it/vendors/osv-scanner

## Standing by category

| Category | Share | Rank | Negative rate | Labels |
|---|---|---|---|---|
| [Software composition analysis](https://www.gane.ai/index/it/developer/software-composition-analysis/index.md) | 0% | 10 | 7% | 14 |

## What the models said for it

- "Use dedicated open-source CLIs like Trivy, Grype, or OSV-Scanner instead of writing custom parsers." (Gemini 3.5 Flash, SCA)
- "Uses the Google OSS Vulnerability database (OSV.dev); highly accurate for reading standard lockfiles" (Qwen 3.7 Flash, SCA)
- "If you only want a lightweight dependency-vulnerability scanner, OSV-Scanner is another free option." (GPT-6 Luna, SCA)
- "For the most accurate dependency matching, especially in CI/CD, OSV-Scanner is a strong pick." (Mistral Small, SCA)

## And against it

- "free deployments often leave monitoring, triage, reporting, and governance to your team" (Perplexity Sonar, SCA)

## By model

| Model | First choice | Alternative | Mention | Warning | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 0 | 0 | 0 | 0 | 0 |
| GPT-5.4 mini | 0 | 0 | 0 | 0 | 0 |
| Gemini 3.5 Flash | 0 | 3 | 0 | 0 | 3 |
| Perplexity Sonar | 0 | 1 | 0 | 1 | 2 |
| Grok 4.20 | 0 | 2 | 0 | 0 | 2 |
| Mistral Small | 0 | 2 | 0 | 0 | 2 |
| DeepSeek V4 Flash | 0 | 0 | 2 | 0 | 2 |
| Llama 4 Maverick | 0 | 0 | 0 | 0 | 0 |
| Qwen 3.7 Flash | 0 | 1 | 0 | 0 | 1 |
| Kimi K2 | 0 | 0 | 0 | 0 | 0 |
| GLM 4.7 FlashX | 0 | 0 | 0 | 0 | 0 |
| MiniMax M2.5 | 0 | 0 | 0 | 0 | 0 |
| GPT-6 Luna | 0 | 2 | 0 | 0 | 2 |
| Muse Glimmer 30B | 0 | 0 | 0 | 0 | 0 |

## Sources returned with these answers

The sites and pages cited by the answers that named OSV-Scanner, from 37 of the 40 answers that named it (only the models that return a source list).

### Domains cited

- github.com: 23
- safeguard.sh: 18
- guideflow.com: 11
- appsecsanta.com: 10
- trivy.dev: 10
- upwind.io: 10
- google.github.io: 9
- bestdevops.com: 8
- owasp.github.io: 8
- sourcegraph.com: 7

### Pages cited

- https://upwind.io/glossary/10-best-software-composition-analysis-tools-for-sca: 10
- https://safeguard.sh/resources/blog/free-alternatives-to-commercial-sca-scanners: 9
- https://appsecsanta.com/sca-tools: 8
- https://guideflow.com/blog/dependency-scanning-software: 8
- https://bestdevops.com/top-10-dependency-vulnerability-scanners-features-pros-cons-comparison: 7
- https://sourcegraph.com/blog/sca-tools: 7
- https://trivy.dev/: 7
- https://appsecsanta.com/sca-tools/open-source-sca-tools: 6

## In its own words

What OSV-Scanner's own pages state, read 2026-09-28. Stated by the vendor, not checked by the index.

- Positioning: Vulnerability Scanner (https://osv.dev/)

## What it publishes

Every page osv.dev exposes, read 2026-09-29: 47093 addresses. By kind, pages and the last 90 days:

- blog: 23 pages, 0 in the last 90 days, latest undated

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.