ORT Server
Skip to main content

ORT ServerOpen source · Eclipse Apoapsis

Software compliance, automated at scale

ORT Server runs the OSS Review Toolkit as a service. Use it to analyze dependencies, licenses and vulnerabilities across all projects in your organization.

Get startedAPI referenceGitHub
ORT Server web UI showing an organization overview with counts of vulnerabilities, issues, rule violations and packages, and a list of products with their latest run status.ORT Server web UI showing an organization overview with counts of vulnerabilities, issues, rule violations and packages, and a list of products with their latest run status.

Fits into your existing toolchain

  • SBOM

    Generate software bills of materials in standard formats.

    • SPDX
    • CycloneDX

  • Integration

    Trigger runs and fetch results from your scripts and CI/CD pipelines.

  • Deployment

    Run it on Kubernetes, installed with Helm and secured with Keycloak.

How it works

From source code to compliance report

Every run follows the proven ORT pipeline. Each stage runs as its own worker, and all stages except the Analyzer are optional, so you can adapt the pipeline to your needs.

  1. Analyzer

    Resolves the full dependency tree for more than 20 package managers.

  2. In parallel
    • Optional

      Advisor

      Checks every package against vulnerability databases.

    • Optional

      Scanner

      Detects licenses, copyrights and code snippets in the source code.

  3. Optional

    Evaluator

    Applies your compliance rules and policies to the results.

  4. Optional

    Reporter

    Produces reports and SBOMs in SPDX, CycloneDX and many other formats.

  5. Optional

    Notifier

    Informs your team when a run finishes.

Features

One place for your compliance data

A web UI that turns ORT results into decisions.

A complete inventory.

A de-duplicated view of every dependency, with declared licenses and source links.

ORT Server web UI showing a filterable list of packages with their declared licenses and homepage links.ORT Server web UI showing a filterable list of packages with their declared licenses and homepage links.
Platform

Built for organizations

  • Powered by ORT

    Builds on the OSS Review Toolkit's analysis, scanning and reporting capabilities, developed in close collaboration with the ORT project.

  • Analysis at scale

    Manage organizations, products and repositories in one central database, and analyze trends across all projects.

  • REST API

    Trigger runs, manage configuration and fetch results from your CI/CD pipelines through a documented OpenAPI interface.

  • Kubernetes-native

    Each pipeline stage runs in its own container and scales horizontally with your workload.

  • Access control

    Authentication, roles and permissions through Keycloak, scoped to organizations, products and repositories.

Community

Built on open source

  • OSS Review Toolkit logo

    OSS Review Toolkit

    ORT Server builds on ORT, the open-source toolkit for license compliance and vulnerability analysis. Both projects share contributors and evolve together.

    Visit oss-review-toolkit.orgView on GitHub
  • Eclipse Foundation logo

    Eclipse Apoapsis

    ORT Server is the reference implementation of the Eclipse Apoapsis project, developed openly under the Eclipse Foundation.

    Visit the project site

Ready to automate your compliance checks?

Deploy ORT Server and run your first analysis.

Read the docsView on GitHub