shouldiuse.io

VERDICT

Should I use Open Source Insights?

Not disclosed - deps.dev

Worth it. Free Google-run tool any developer should use to research open-source package health and security. It is not a compliance product; teams needing policy enforcement still need commercial SCA.

Confidence

Medium. Based on ~20 public sources; mostly official Google pages with light independent review coverage.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo support channels in evidence
  • Security posture

Pricing

$0

Everything

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes

Best for

  • Developers vetting npm, Go, PyPI packages
  • Open-source maintainers checking project health
  • Security teams researching dependency risk
  • Analysts using the public BigQuery dataset

Not for

  • Teams needing license compliance or SBOM generation
  • CI/CD policy enforcement — you want a real SCA tool
  • Buyers wanting SLAs, contracts, or vendor accountability
  • Non-technical managers — it is a raw developer research tool

Gotchas - check before you buy

medium

Launched as an exploratory Google project — could be sunset without notice

medium

No SLAs or paid support; help is community and documentation only

low

Guess: heavy BigQuery analysis may incur Google Cloud query costs

Pros and cons

Pros

  • Continuously scans millions of open-source packages
  • Free public API for dependency and advisory data
  • Public BigQuery dataset enables custom analysis
  • Transitive dependency graphs surface indirect risk

Cons

  • Research only — no remediation workflows or policy enforcement
  • No commercial support or SLAs; Google project, not a vendor
  • Analyzes public packages, not your private repositories

Sources & method

Analyzed 9/20/2026 - 10 sources - No known vulnerabilities found in the sources reviewed.

official x5review x2security x1news x2

Key stats

  • Value for money: 5/5

    Rating

  • $0

    Starting price

  • 10

    Sources

  • Analyzed

  • Value for money: 5/5. Free, Google-backed, no cost at all
  • Ease of use: 4/5. Simple lookups plus a free API
  • Feature depth: 4/5. Graphs, advisories, BigQuery dataset; insight only
  • Support quality. No support channels in evidence
  • Security posture: 4/5. Google-run with a published security page
  • Free Price Public Google service; no paid tiers found
  • June 2021 Launched Google Open Source Insights project
  • Google Operator Part of Google's open-source programs
  • Apr 2023 Public API Free API for dependency and advisory data

Pricing

Everything

$0

  • Website lookups across ecosystems
  • Public deps.dev API
  • BigQuery public dataset access

Security

No known vulnerabilities found in the sources reviewed.

What users say

Developers treat deps.dev as a useful dependency research tool and have built their own API clients, but formal reviews are scarce.

Alternatives

Compare Open Source Insights with each alternative.

  • OWASP Dependency-Check

    Free scanner you run inside your own pipeline

  • Snyk

    Commercial SCA with CI gates and fix PRs

    Open Source Insights vs Snyk

  • Sonatype

    Enterprise open-source governance and policy enforcement

  • OpenSSF Scorecard

    Project health scores; feeds deps.dev directly

Full analysis

Based on ~20 public sources; mostly official Google pages with light independent review coverage.

Free Google tool for open-source dependency security and health. Great research aid, not an enterprise SCA product.

Methodology

Based on ~20 public sources; mostly official Google pages with light independent review coverage.

Sources

  1. Open Source Insightsdeps.dev
    official
  2. Open Source Insights FAQdocs.deps.dev
    official
  3. Introducing the Open Source Insights Projectopensource.googleblog.com
    official
  4. Announcing the deps.dev APIsecurity.googleblog.com
    official
  5. Using the Open Source Insights datasetcloud.google.com
    official
  6. Deps.dev glossary entrycrashoverride.com
    news
  7. New Google tool reveals dependencieshelpnetsecurity.com
    news
  8. Open source client for deps.dev APIreddit.com
    review
  9. Score card for dependencies, r/rustreddit.com
    review
  10. Product security pagedeps.dev
    security

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.