What Dependency-Track does well
A mature project with a large community. Details from dependencytrack.org and the OWASP project page.
A hosted alternative to OWASP Dependency-Track
Dependency-Track is a free, open-source platform for SBOM analysis, and an OWASP Flagship project. You run it yourself. MopokeHQ does the same core job as a hosted service, then adds triage, fix merge requests, deployment confirmation and compliance evidence.
The short answer
Keep Dependency-Track if
You want free software, full control of where it runs, and you have someone to host and maintain it.
Look at MopokeHQ if
You would rather not run a server, you need to know which fixes reached production, or you want SBOM findings next to secrets, SAST, container and external scan results.
- Free and open source under Apache-2.0.
- CycloneDX native. SBOMs go in through the REST API, CI plugins or the UI.
- More advisory sources: NVD, GitHub Advisories, Sonatype OSS Index, Snyk and OSV, with EPSS.
- A policy engine for security, operational and licence rules that can fail a build.
- Continuous re-analysis of the whole portfolio as new vulnerabilities land.
- Self-hosted, so the data stays on infrastructure you control.
What MopokeHQ does differently
Less to run, and more of the response handled after the match.
How it works- Nothing to host. One CI include line runs the
mopokeCLI on your runner. It builds the SBOM with syft and uploads it. - Deployment truth. Each exposure is Confirmed live, Likely live or Possible, and closes only when the fixed version is seen deployed.
- Priority and SLAs from CVSS, KEV, EPSS, live confidence and project criticality.
- A fix roadmap that groups work by upgrade across projects, plus fix merge requests from your runner.
- More than dependencies: containers, SAST, secrets, DAST, IaC and licences from one pinned image.
- Client notices and evidence packs for agencies and audits.
Feature comparison
Dependency-Track details checked on 23 October 2026.
| Dependency-Track | MopokeHQ | |
|---|---|---|
| Licence | Apache-2.0, free | Commercial service |
| Hosting | You run it (containers, Docker Compose quick start) | Hosted, data stored in Sydney |
| Getting SBOMs in | CycloneDX through the REST API, CI plugins or the UI | Built for you by syft on your runner and uploaded |
| Advisory sources | NVD, GitHub Advisories, Sonatype OSS Index, Snyk, OSV, with EPSS | OSV, php.net security releases, CISA KEV, with EPSS |
| Continuous re-analysis | Yes | Yes |
| Policy engine | Expression engine for security, operational and licence rules | Merge request gate on new findings, licence scanning |
| Deployment-aware confidence | Not on the pages we read | Confirmed live, Likely live, Possible |
| Fix workflow | Notifications, Jira and DefectDojo integrations | Now roadmap, fix merge requests, closed when seen deployed |
| Other scanners | SBOM component analysis | Containers, SAST, secrets, DAST, IaC, licences, external scans |
| Client notices, evidence packs | No | Yes |
| CI support | Any CI | Any CI through the CLI; GitLab in depth, more platforms coming |
Running it with DefectDojo
Many teams pair the two: Dependency-Track for SBOM analysis, DefectDojo for findings from other scanners. It works, but it is two systems to host, upgrade and connect. MopokeHQ covers both jobs for teams on GitLab.
DefectDojo vs MopokeHQCost
Dependency-Track costs nothing to license. You pay for hosting and for the time to run it. MopokeHQ is a subscription priced by active projects, with unlimited users.
How MopokeHQ pricing worksQuestions
What is Dependency-Track?
An open-source OWASP Flagship platform that analyses CycloneDX SBOMs for vulnerable and outdated components, and keeps re-checking them as new advisories land.
Is Dependency-Track free?
Yes. It is licensed under Apache-2.0. You pay for the hosting and the time to run and upgrade it.
Is there a hosted version of Dependency-Track?
None is mentioned on the project’s own pages. You run the API server and frontend yourself.
Does Dependency-Track integrate with DefectDojo?
Yes. Both projects document the integration, and running the two together is a common setup.
What are some alternatives to Dependency-Track?
Hosted options include Snyk, GitLab Ultimate’s dependency scanning, and MopokeHQ for teams on GitLab Free or Premium.
Put a mopoke on night watch
One job in your CI pipeline. Your first SBOM is matched against every advisory we hold within minutes.