Integrate ClearlyDefined with Vulnetix. Query the ClearlyDefined REST API to retrieve curated licence and copyright definitions for open-source components, enriching your SBOMs before upload.
How Vulnetix compares: better together
Vulnetix does not replace ClearlyDefined. Keep running it. Vulnetix sits on top of ClearlyDefined (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
ClearlyDefined is strongest at its core category and also carries features in SCA, just as Vulnetix spans categories.
| Capability | Vulnetix | ClearlyDefined |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✗ |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ~ Provides per-package clarity data keyed by coordinates; consumers use it for dependency license lookup, not vuln scanning |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✗ |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✗ |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✗ |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✗ |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✗ |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✓ Core: curated license + copyright metadata harvested via ScanCode/FOSSology/Licensee across 10+ ecosystems |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✗ |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✗ |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ✗ |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What ClearlyDefined does well
- Crowdsourced, community-curated license and copyright metadata with a human vet/discuss/merge curation workflow under the Open Source Initiative
- Automated harvesting that runs ScanCode, FOSSology and Licensee across packages and aggregates the best-available license determination
- Broad ecosystem coverage: crate, deb, gem, go, maven, npm, nuget, composer, pod, pypi plus GitHub source origins
- Free public REST API usable without authentication, ideal as an upstream license-clarity data source
Where Vulnetix adds to it: ClearlyDefined is a license/copyright data service, not a vulnerability platform. It does no vuln, container, IaC, secrets or malware scanning. Vulnetix runs all those engines natively and adds cross-scanner dedup, exploit-intel, reachability, versioned VEX, autofix and SSVC, plus its own license scanning. Vulnetix can consume ClearlyDefined-style curated license clarity as an authoritative upstream input while owning the security-orchestration layer.
No migration, no rip-and-replace. ClearlyDefined keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise ClearlyDefined results in Vulnetix
Upload ClearlyDefined JSON, SPDX output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.