SCA and dependency vulnerability scanner CLI.

Radar checks dependency risk from bundled and cached vulnerability data, giving developers a software composition analysis CLI for supported lockfiles.

Run this check locally Inspect sample finding

radar scan . --quick

Lockfile vulnerability scanner

Scan common package ecosystems and report advisory identifiers in the same merge-readiness output.

Cargo.lock
package-lock.json
pnpm-lock.yaml
requirements.txt

SCA

Evidence to inspect

Use “SCA and dependency vulnerability scanner CLI.” as the scope for this decision: verify the input, finding detail, workflow handoff, and product boundary before you install or buy.

CriterionEvidence to inspectBoundary

Input scopeSelected files, configuration, scan mode, and enabled rules.Only included paths and configured checks are evaluated.

Finding detailFile, line, rule ID, severity, explanation, and repair direction.Illustrative output is not a result from your repository.

Workflow handoffLocal result, report format, agent context, and optional CI signal.Enable exports or CI only when the workflow needs them.

Decision fitUse the same criteria on a real repository before choosing a plan or tool.No universal winner or guaranteed outcome is claimed.

SCA

Run this check locally

SCA for developers

Emit SARIF and JSON so dependency findings can show up next to code scanning alerts without splitting local review across separate tools.

Official source

Primary sources

NISTSecure Software Development Framework (SSDF) 1.1
GitHub DocsUploading a SARIF file to GitHub

Validate the workflow on your own code.

Apply this page’s evidence to one real repository. For “SCA and dependency vulnerability scanner CLI.”, confirm which finding is produced, whether the proposed next step is reproducible, and where local scanning, reports, agents, or CI should stop or expand.