JFrog Xray

Best Self Hosted Alternatives to JFrog Xray

A curated collection of the 2 best self hosted alternatives to JFrog Xray.

JFrog Xray is a software composition analysis (SCA) service that scans packages, binaries, container images and build artifacts for vulnerabilities, license and compliance risks. It performs deep recursive scans, produces SBOMs, enforces policies, and integrates with CI/CD and artifact repositories.

Alternatives List

#1
Cupdate

Cupdate

Cupdate auto-detects container images in Kubernetes, Docker or Podman, finds newer versions and exposes results via a UI, API and RSS feed with vulnerability metadata.

Cupdate screenshot

Cupdate is a lightweight, zero-configuration service that discovers container images running on Kubernetes, Docker or Podman hosts, identifies newer available image versions, and surfaces version and vulnerability metadata through a UI, API and RSS feed.

Key Features

  • Auto-detects container images in use across Kubernetes clusters or Docker/Podman hosts (single or multiple, local or remote)
  • Identifies latest available image versions and correlates them with deployed versions
  • Vulnerability data aggregation using registry or third-party sources (e.g., Docker Scout, Clair, GitHub Advisories, OSV) when available
  • Visual UI for browsing images, versions, dependants and release notes
  • Machine-friendly APIs and RSS feeds for integrations and automation
  • Lightweight design with low CPU and memory footprint suitable for running alongside existing infrastructure
  • Supports multiple OCI registries and common hosts (examples: docker.io, ghcr.io, quay.io, registry.k8s.io and other OCI-compliant registries)

Use Cases

  • DevOps teams auditing deployed container images to prioritize manual upgrades
  • Security teams reviewing aggregated vulnerability metadata for images in production
  • Platform or SRE engineers building dashboards or automation that integrate image/version data via the API or RSS

Limitations and Considerations

  • Cupdate does not perform deployments or modify manifests; it is intended as a discovery and reporting/dashboard tool, not an automated updater
  • Podman support is labelled beta and requires Docker socket compatibility mode; behavior and compatibility may change
  • Vulnerability coverage depends on participating registries and available SBOMs/advisories; not all images or registries will provide full scan data

Cupdate is intended as a discovery and observability tool to help teams see what container images are in use and what updates exist. It is suited to complement CI/CD or automated manifest-updater services rather than replace them.

296stars
6forks
View Details
#2
Secrover

Secrover

Secrover generates human-readable HTML security audit reports for repositories and domains. Scans dependencies, code, and domains; supports scheduling and remote exports.

Secrover screenshot

Secrover is a free, open-source tool that automates generation of clear, professional HTML security audit reports for code repositories and domains. It combines dependency scanning, static code checks, and domain/SSL checks into a single shareable report.

Key Features

  • Dependency vulnerability scanning using OSV-based scanners to report known issues across supported languages
  • Static code checks via integrated search tools to surface potentially risky code patterns
  • Domain and hosting audits: SSL/TLS, redirects, security headers, open ports, and basic hosting location info
  • Produces standalone human-readable HTML reports suitable for stakeholders and public sharing
  • Automation support: run one-off scans via Docker or schedule recurring scans using an internal cron (Supercronic)
  • Remote export options for reports using rclone-compatible destinations (S3, SFTP, WebDAV, SMB, Google Drive)
  • Support for private GitHub repositories via HTTPS Personal Access Token

Use Cases

  • Generating repeatable security audit reports for open-source projects or internal repositories
  • Producing client-facing or compliance-ready HTML reports after dependency and code scans
  • Integrating scheduled security scans into CI workflows and exporting results to cloud storage or intranet sites

Limitations and Considerations

  • Private repository cloning currently works only over HTTPS with a GitHub Personal Access Token; SSH is not supported
  • Dependency scanning and language coverage depend on the capabilities of the integrated external scanners (e.g., OSV scanner)
  • Scans of very large repositories or many targets may be resource- and time-intensive when run in single-container setups

Secrover is a practical choice when you need transparent, shareable security audit reports without a proprietary SaaS dependency. It is designed for simple Docker-based deployment, automation via cron or CI, and flexible export destinations for report distribution.

235stars
4forks
View Details

Why choose an open source alternative?

  • •Data ownership: Keep your data on your own servers
  • •No vendor lock-in: Freedom to switch or modify at any time
  • •Cost savings: Reduce or eliminate subscription fees
  • •Transparency: Audit the code and know exactly what's running