FOSSA

FOSSA is a software composition analysis platform that brings dependency, license, and vulnerability checks into development workflows. It is best suited to teams that need shared policy enforcement and SBOM management as well as scanning. The main trade-off is that its most useful controls sit alongside strict Free-plan caps, while a quick source import is less complete than a CLI scan.

Overview

FOSSA combines open-source dependency analysis with license, security, and quality policies that can apply across an organization and block builds. That makes it more compelling as part of a development and release process than as an occasional license checker. It supports more than 30 languages, including JavaScript and TypeScript, Java and Kotlin, Python, Go, Ruby, Rust, Clojure, Elixir, Swift,.NET, PHP, and others.

Teams can scan through the CLI or CI/CD, analyze containers, detect snippets, import source from code hosts, or upload enterprise binaries and SBOMs. Quick Import does not run the build and produces less complete results than CLI scanning. It is useful for an initial view, but teams making release or compliance decisions should prefer a CLI scan where practical.

Key features

FOSSA supports generating, importing, exporting, and managing SBOMs, alongside reachability analysis and pull-request scanning. That breadth suits teams that want inventory and policy checks connected to developer workflows rather than a separate, manual compliance step. Documented integrations include Jira, GitHub, Slack, Bitbucket, GitLab, APIs, and OIDC providers.

FOSSA documents an on-premises deployment operated in a customer's own infrastructure using Kubernetes and Helm. Its Trust Center lists SOC 2 compliance, data encryption, and penetration testing controls. Those capabilities may matter to organizations with deployment or assurance requirements, though the Enterprise plan is the one that adds enterprise SLAs and custom retention policies.

Pricing

FOSSA uses a freemium model, with a Free plan and paid pricing from $20/mo (annual). The Free plan costs nothing, forever, and includes 5 projects, 10 contributing developers, 1 release group, 5 dependency levels for scans, 1 quality check, and 5 imported SBOMs. Basic email support is included. Those caps make it a bounded starting point, not a generous long-term tier for a growing team.

Business is shown at $2,020,710 a year, billed annually. It allows 10 projects / SBOM imports, 10 contributing developers, and 1 release group, with unlimited dependency levels and the full suite of quality checks. Priority support is included. It is the natural step up for teams that have outgrown Free's scan-depth and quality-check limits, but the project/import and developer allowances remain finite.

Enterprise has custom pricing and offers unlimited projects, custom developer counts, unlimited release groups and dependency levels, enterprise SLAs, and custom retention policies. It is aimed at organizations that need scale and tailored service terms rather than a fixed allowance. A free trial is available.

Platforms

FOSSA lists API, Linux, self-hosted, and web platforms, with hybrid deployment options. The on-premises Kubernetes and Helm route gives infrastructure teams a way to run it in their own environment; the service also connects with common code hosts and collaboration tools.

Who it's for

FOSSA is aimed at developers, security teams, and legal counsel working together on open-source risk and policy. It fits organizations that need scans tied to builds, organization-wide rules, and SBOM workflows. A user who only needs an occasional code scan may find the policy and management scope unnecessary, while teams relying on Quick Import alone should account for its less complete results.

Pros and cons

Broad scanning and ecosystem coverage: CLI and CI/CD, container analysis, snippet detection, and support for more than 30 languages suit varied development workflows.

Policy can stop noncompliant builds: Organization-wide license, security, and quality rules connect findings to release decisions.

SBOM workflows are built in: Generation, import, export, and management reduce the need to treat SBOMs as a separate task.

Free is tightly capped: Five projects, ten contributing developers, one quality check, and five imported SBOMs can constrain adoption beyond a small evaluation.

Quick Import trades completeness for convenience: Because it skips the build, it is a weaker basis for decisions than CLI scanning.

Business has finite project and seat allowances: Its expanded checks do not remove the limits of 10 projects / SBOM imports and 10 contributing developers.

Alternatives

For teams that want a free, self-hosted code-scanning tool, ScanCode Toolkit is a simpler alternative; it does not carry the stated FOSSA policy and SBOM-management scope. ScanCode.io is also free and runs as a Docker container or on a Linux server, with no commercial plan or usage limits stated. Choose it when that deployment model and free availability fit better than FOSSA's capped plans.

FOSSology is a free open-source license compliance toolkit and system, a fit when license compliance is the narrower need. SBOM Workbench is a free download for readers seeking an open-source desktop option across Linux, macOS, and Windows. licscan is a free Apache 2.0 standalone CLI billed at $0 per scan, while OHRisk is a free open-source CLI under the MIT License; either is a more focused choice for a reader who wants a command-line tool.

DejaCode is another option for readers who want a paid, self-hosted and web-accessible tool with a free plan and trial; its Team plan is $500 a month on an annual subscription. OSSKB is free of charge and may suit readers seeking a best-effort service, with transaction frequency potentially limited. For category browsing, compare Open Source License Compliance Software, SBOM Management Software, Dependency Management Software, and Software Composition Analysis Software.

Verdict

Choose FOSSA if developers, security, and legal teams need dependency and vulnerability scanning tied to enforceable policy and SBOM workflows. Its broad scanning methods and controls are the case for buying it; the Free caps, finite Business allowances, and less-complete Quick Import are reasons to look elsewhere or plan carefully for CLI-based use.