MoreSec SCA

MoreSec SCA (雳鉴SCA) is a software composition analysis system designed to identify and manage third-party component security risks during the software development lifecycle (SDL/DevSecOps) and across the software supply chain. The product integrates with code repositories such as SVN, GIT, TFS, and Mercurial without requiring changes to existing development workflows or organizational structures. It combines AI agent and large language model capabilities to automate component security detection, manage risk component lifecycles, and provide visibility into third-party components. Key capabilities include: - Detection through code repository pulling, code file uploads, and image scanning - Source code detection support for Java, Python, C, C++, C#, Go, PHP, and more than a dozen languages - Static detection based on package manager configuration and dynamic detection via simulated builds - Proprietary AI algorithms for code snippet detection to help identify unknown components - Analysis of component risk types, versions, licenses, and vulnerabilities - Multi-level display of component and file dependency trees - Identification of component usage status and distinction between official and unofficial components - CVSS-based scoring for vulnerability severity analysis - Software Bill of Materials (SBOM) import, parsing, and export - Quality gate management to block download and reference of risky components - Security baseline configuration based on a central repository - AI agent features for component remediation prioritization, reference verification, and one-click fixes for risky components The product has been referenced in the Gartner Software Composition Analysis (SCA) Market Guide (2020-2021) and the Gartner SCA China Security Technology Maturity Curve (2022).