Loading SOVA...
Loading SOVA...
Offline Dependency Extraction for Regulated Industries
For organizations that can't share source code with external platforms. SOVA CLI runs locally on any machine, extracts dependency metadata and detects 120+ supply chain attack signals with zero network calls, and produces a portable manifest for upload to SecureNexus — enabling full SBOM generation, vulnerability analysis, security signal detection, and compliance reporting without ever exposing your proprietary code.
The Problem
Defense, healthcare, finance, and critical infrastructure operate in restricted networks. Cloud-based SCA tools simply don't work. Your developers in secure environments deserve the same visibility as everyone else.
40%
Of enterprises have air-gapped systems
Regulated industries operate significant portions of their infrastructure in air-gapped or restricted networks where cloud SCA tools cannot reach.
Zero
Offline SCA tools with full language support
Most SCA tools require cloud connectivity for vulnerability databases and analysis. SOVA CLI works entirely offline with 26+ language support.
npm install
One command deployment
SOVA CLI installs via npm (@securenexus/sova) and runs immediately. No complex setup, no cloud configuration, no network requirements.
Install via npm registry or download the package for air-gapped environments. Works on any machine with Node.js 18+.
$ npm install -g @securenexus/sova
added 1 package in 3.2s
$ sova scan --path ./my-project
Scanning... 247 dependencies found across 3 languages
✓ Manifest saved to sova-manifest.json
For environments without npm registry access. Download the .tgz package, transfer via approved media, and install locally.
securenexus-sova-1.0.0.tgz
181 KB — npm tarball package
$ npm install -g ./securenexus-sova-1.0.0.tgz
added 1 package in 3.2s
$ sova scan --path ./my-project
Interactive Mode
Guided wizard with language selection and configuration prompts
Direct Scan Mode
CI/CD friendly — scan current directory, output to file, no prompts
Point SOVA at any project directory. It recursively detects every manifest and lock file across 26+ languages, parses Dockerfiles (including RUN commands), and builds a complete dependency graph. Zero network calls — everything runs on your machine.
$ sova scan --path /projectSOVA outputs a single sova-manifest.json file containing only dependency metadata — package names, versions, relationships, and ecosystem identifiers. No source code, no environment variables, no secrets. The file is typically under 300 KB even for monorepos with thousands of dependencies.
output → sova-manifest.jsonUpload the manifest to securenexus.ai/generate to generate a full CycloneDX SBOM with vulnerability analysis, license compliance scoring, dependency graph visualization, and reachability analysis. Transfer the file via any approved channel — USB, SFTP, or email.
→ securenexus.ai/generateSOVA parses lock files, build manifests, Dockerfiles, Terraform configs, GitHub Actions workflows, and even CDN script tags in HTML — extracting every dependency regardless of ecosystem.
Upload your sova-manifest.json to SecureNexus and receive a full CycloneDX SBOM enriched with vulnerability intelligence, license analysis, and supply-chain metadata.
Every known CVE mapped to your dependency tree, plus 120+ supply chain attack signals — install scripts, obfuscation, dependency confusion — for complete threat context.
SPDX-standard license identification across every component for compliance review.
Full transitive dependency tree with parent-child edges for blast-radius analysis.
Rich component metadata for asset inventory and supply-chain provenance tracking.
Banking, healthcare, and government organizations operate under strict data governance. SOVA ensures dependency analysis happens locally — no source code is transmitted to third-party SaaS platforms. Meets NIST 800-171, SOC 2, HIPAA, and FedRAMP data handling requirements.
Defense contractors, intelligence agencies, and critical infrastructure operators work on networks with zero internet access. SOVA requires no network connectivity after installation — scan locally, transfer the manifest via approved media, and upload from a connected machine.
When clients or regulators require a software bill of materials, share the SOVA manifest instead of source code. Auditors get complete dependency visibility — package names, versions, license data, and vulnerability exposure — without ever seeing proprietary code.
Embed SOVA in your build pipeline as a pre-deploy gate. Run sova scan in CI, upload the manifest via API, and block releases with critical vulnerabilities. Works with GitHub Actions, GitLab CI, Jenkins, Azure DevOps, and any system that runs Node.js.
Install SOVA CLI and scan your first project in under 5 minutes