mergebase.com

What It Is

MergeBase is a Software Composition Analysis (SCA) platform for software supply chain security. Its core purpose is to identify and manage open-source component vulnerabilities, license risks, and SBOM requirements in applications. It covers code commits, build pipelines, containers, and runtime environments, emphasizing “always-on vulnerability management” to reduce the software supply chain attack surface and enable faster response to urgent vulnerabilities such as Log4j.

Core Capabilities and Integrations

In terms of protection scope, MergeBase is primarily an SCA solution. It supports open-source dependency vulnerability scanning, license policy checks, container scanning, SBOM generation, and Dynamic Application Surveillance and Hardening in the Enterprise tier. The materials particularly highlight reduced false positives, identification of vulnerability risk in unused code, and upgrade recommendations based on risk, compatibility, and popularity. Deployment options mainly include a SaaS dashboard, plugins, GitHub Action, CLT, and API, while Enterprise supports private cloud or on-premises data center deployment.

Its integration coverage is fairly comprehensive: on the source code side, it supports GitHub, Bitbucket, and GitLab; for CI/CD, it supports Jenkins, Bamboo, TeamCity, Azure DevOps, Bitbucket Pipelines, GitHub Action, and any platform capable of running custom scripts; for security operations, it supports QRadar, Splunk, RFC-5424, LEEF, Slack, Teams, Jira, ThreatConnect, Kenna, Nucleus, and API. Management and alerts can be routed to the dashboard, SIEM, collaboration tools, and ticketing systems.

Pricing and Target Users

The Team plan is listed at $38 per active developer/month and includes CI/CD, license analysis, container scanning, Jira/Boards, and email support. Business pricing is not disclosed, and adds SBOM, SIEM, custom policies, Slack/Teams, and technical debt analysis. Enterprise is custom-priced and includes runtime hardening, runtime monitoring, SSO, on-premises deployment, Auto PR, and dedicated support. MergeBase is best suited to mid-to-large engineering organizations with existing DevSecOps processes that need to govern open-source dependencies and SBOMs, especially in Java, .NET, containerized, and multi-pipeline environments.

Pros, Cons, and Access from China

Strengths include broad SDLC coverage, rich enterprise integrations, and runtime protection as a differentiating capability. Limitations include opaque Business/Enterprise pricing, key capabilities such as runtime protection, on-premises deployment, and SSO being reserved for higher tiers, and no compliance certifications disclosed in the available materials. Access from China is not covered in the collected text, so it is considered unknown; payment methods are also not disclosed. Domestic users with requirements around network connectivity, invoicing, data residency, or local support may also want to evaluate Snyk, Mend, Sonatype, JFrog Xray, GitHub Dependabot, as well as China-based software supply chain security vendors.