Open-source supply-chain scanner & toolkit · made & hosted in the EU · CRA-ready
Supply-chain security that stays in Europe.
OtterSight finds known vulnerabilities in your dependencies and generates CycloneDX SBOMs. The CLI scans locally, your code never leaves your machine. The dashboard clones and scans your repository in Germany and discards the checkout after the scan.
Try the CLI · MIT Syft + Grype run locally · output as table, Markdown or SARIF
npx @ottersight/cli scan . my-shop-api 214 packages · 4 findings · 1 KEV
Depth meter Deepest finding · Critical · −80 m
210 · 0 m
1 · −5 m
1 · −20 m
1 · −40 m
Ollie 1 · −80 m
| Package | Version | Advisory | Severity | Fixed in | KEV |
|---|---|---|---|---|---|
| lodash | 4.17.20 | CVE-2021-23337 | 4.17.21 | KEV | |
| express | 4.17.1 | CVE-2024-9266 | 4.21.0 | ||
| axios | 0.21.1 | CVE-2023-45857 | 1.6.0 | ||
| semver | 7.5.3 | CVE-2022-25883 | 7.5.4 |
Deepest first, KEV breaks tiesGrype · EUVD · CISA KEV · EPSS
- ✓ T1 Open source (MIT) Code and scanner on GitHub
- ✓ T2 CLI & MCP scan locally Your code never leaves your machine
- ✓ T3 Hosted in Germany Dashboard · Hetzner, Germany
- ✓ T4 ENISA EUVD built in EU vulnerability database
- ✓ T5 CycloneDX SBOM Standard export
- ✓ T6 CRA-ready SBOM + vulnerability handling per Annex I Part II
01
How it works
Two modes, same data. You decide where the scan runs.
Mode A · local · MIT CLI & MCP server
- 01 Run it in your project folder
npx @ottersight/cli scan . - 02 Scan locally Syft builds the SBOM, Grype matches it against vulnerability data. Both run on your machine.
- 03 Use the result Terminal table, Markdown or SARIF for your CI. Hide accepted findings with --ignore. Via the MCP server, from your AI assistant too.
Mode B · hosted in Germany Dashboard
- 01 Connect a GitHub repository You choose which repositories are scanned.
- 02 Scan in Germany The repository is cloned and scanned in an isolated container in Germany. The checkout is discarded after the scan.
- 03 Get notified SBOM and findings are stored. Alerts to Slack, Discord, Telegram, email and 300+ more channels via Apprise.
02
Severity = depth
The deeper Ollie dives, the more serious the worst open finding. Every level carries three signals: depth segments, the word, and red for critical only.
Clean 0 m · no findings floating on its back
Low −5 m · CVSS 0.1–3.9 head up, curious
Medium −20 m · CVSS 4.0–6.9 half in the water
High −40 m · CVSS 7.0–8.9 eyes above water
Critical −80 m · CVSS 9.0–10.0 fully submerged
03
Data-flow transparency
Where your code is processed, what is stored, and which jurisdiction the vulnerability data comes from.
Mode A · localCLI & MCP server
Input
Vulnerability data, downloadedProcessing
Your machine Syft + Grype run locally. Your code never leaves your machine.
Stored
Results stay with you. Nothing is uploaded.Mode B · hosted in GermanyDashboard
Input
Your GitHub repository (connected by you) + vulnerability dataProcessing
OtterSight servers, Germany Isolated container at Hetzner · checkout discarded after the scan
Stored
SBOM + findings, stored in Germany| Data source | Operator | Jurisdiction | Direction | Receives your code |
|---|---|---|---|---|
| Grype vulnerability database | Anchore | US | Downloaded | No, in neither mode |
| ENISA EUVD | ENISA (EU agency) | EU | Downloaded | No, in neither mode |
| CISA KEV | CISA (US agency) | US | Downloaded | No, in neither mode |
| EPSS | FIRST | US | Downloaded | No, in neither mode |
| Package registries | npm, PyPI, Maven … | Mostly US | Downloaded | No, in neither mode |
04
Features
What the scanner does today. Each entry names the mode it is available in.
F01 CLI · Dashboard
20+ ecosystems Package detection via Syft, incl. npm, PyPI, Maven, Go, Cargo. F02 CLI · Dashboard
CycloneDX 1.6 An SBOM with every scan, exportable as a file. F03 Dashboard
CVSS + EPSS + CISA KEV Severity, exploit probability and known exploitation in one rating. F04 CLI · Dashboard
ENISA EUVD EUVD IDs next to CVE IDs. F05 CLI
Table, Markdown, SARIF Read it in the terminal, post it in PRs or load it into code scanning. F06 CLI
--ignore Hide findings you have deliberately accepted. F07 MCP
MCP server AI assistants and agents run scans locally and read the findings. F08 Dashboard
Alerts via Apprise Slack, Discord, Telegram, email and 300+ more channels. F09 Dashboard
Version drift Shows when dependencies drift apart between scans or repositories. F10 Dashboard
Multi-tenant teams Separate tenants for teams and organisations. 05
Cyber Resilience Act
The CRA requires manufacturers of products with digital elements to know their software supply chain and handle vulnerabilities. OtterSight provides tools for that. Responsibility stays with the manufacturer.
Requirement What the CRA asks for How OtterSight helps
SBOM A software bill of materials in a common, machine-readable format, covering at least the top-level dependencies. A CycloneDX 1.6 SBOM with every scan, locally with the CLI or in the dashboard.
Vulnerability handling Identify, document and remediate vulnerabilities in components without undue delay. Findings with CVSS, EPSS, KEV and EUVD reference, fix version per package, version drift and alerts on new findings.
Reporting duties Report actively exploited vulnerabilities and severe incidents. These duties apply since 11 September 2026. The KEV flag shows known exploitation right on the finding, alerts reach your team immediately. You file the report yourself.
The remaining CRA obligations apply from 11 December 2027. This overview is not legal advice. OtterSight does not replace a conformity assessment.
06
Pricing
The CLI and MCP server are open source (MIT) and free. The dashboard starts with a waitlist.
Founding Member 0 of 100 spots taken
€5 per month
Price locked for as long as your subscription runs. - Dashboard, hosted in Germany
- 15 repositories · daily monitoring
- SBOM + findings per repository
- Alerts via Apprise, 300+ channels
- Version-drift detection
Waitlist Reserve your spot
0 findings — as it should be