Skip to content
SPECIFICTION
Get listed

ScanCode Toolkit

scancode-toolkit.readthedocs.io

Free plan WindowsmacOSLinuxAPISelf-hosted
Visit scancode-toolkit.readthedocs.io
Spec score 7.7 #14 of 28 in Open Source License Compliance Software

What it is

ScanCode Toolkit is a free tool for scanning codebases for origin, copyrights, licenses, vulnerabilities, packages, and dependencies. It can run as a command-line tool or as a library within an application. Its license detection compares text extracted from files with an index of license texts and rules. Scanning can recursively unpack archives and extract text from binary files when needed, while package support covers manifests, lockfiles, and package datafiles. Results can be saved as JSON, YAML, JSON Lines, HTML, SPDX, Debian copyright, or CycloneDX; CSV is marked deprecated. JSON results can feed ScanCode Workbench and other applications that accept ScanCode data. Plugins extend processing stages, and external plugins can add license data. Installation options include release archives, Docker, source, pip, and Fedora’s repository. Linux, macOS, and Windows are listed as tested platforms, with 64-bit operating system and Python requirements. The project points users to community Slack and GitHub discussions for help; scan output is provided without warranties and is not legal advice.

Spec sheet

Purpose
ScanCode Toolkit scans codebases to detect code origin, copyrights, licenses, vulnerabilities, packages and dependencies.Read 2 Oct 2026 · scancode-toolkit.readthedocs.io
Support
The project directs users to its community Slack and GitHub discussions for questions and challenges.Read 2 Oct 2026 · scancode-toolkit.readthedocs.io
Headquarters
Los Altos, California, United StatesRead 28 Sep 2026 · scancode-toolkit.readthedocs.io
Founded
2003Read 28 Sep 2026 · scancode-toolkit.readthedocs.io
Archive scanning
The scanning process extracts files recursively from archives and extracts text from binary files when needed.Read 2 Oct 2026 · scancode-toolkit.readthedocs.io
Extensibility
Plugins can extend ScanCode at different stages, and users can add license data through external plugins.Read 2 Oct 2026 · scancode-toolkit.readthedocs.io
Installation
Installation options include release archives, Docker, source, pip, and Fedora’s repository.Read 2 Oct 2026 · scancode-toolkit.readthedocs.io
Integration
JSON scan results can be consumed by ScanCode Workbench and other applications that accept ScanCode result data.Read 2 Oct 2026 · scancode-toolkit.readthedocs.io
Legal limitation
The scan output says ScanCode is provided as-is without warranties and that its content should not be used as legal advice.Read 2 Oct 2026 · scancode-toolkit.readthedocs.io
License detection
License detection searches an index of license texts and rules for matches in extracted file text.Read 2 Oct 2026 · scancode-toolkit.readthedocs.io
Maker history
nexB says it was founded in 2003 by Michael J. Herzog, Philippe Ombrédanne and François Granade.Read 2 Oct 2026 · nexb.com
Output formats
Scan results can be written as JSON, YAML, JSON Lines, HTML, SPDX, Debian copyright, or CycloneDX; CSV is marked deprecated.Read 2 Oct 2026 · scancode-toolkit.readthedocs.io
Package support
It supports a wide variety of package manifests, lockfiles and package datafiles containing package and dependency information.Read 2 Oct 2026 · scancode-toolkit.readthedocs.io
Platform requirements
The documentation lists Linux, macOS and Windows as tested platforms and specifies 64-bit operating systems and Python requirements.Read 2 Oct 2026 · scancode-toolkit.readthedocs.io
Use modes
It can be used as a command-line tool or as a library in an application.Read 2 Oct 2026 · scancode-toolkit.readthedocs.io

Plans and prices

ScanCode Toolkit Free Free software code scanning tool Read 2 Oct 2026 · scancode-toolkit.readthedocs.io

Every ScanCode Toolkit plan and price →

Strong points and limits

Strong points

  • Runs as a command-line tool or application library.
  • Exports SPDX and CycloneDX formats.
  • Plugins can extend processing and license data.
  • Supports recursive archive scanning.

Limits

  • CSV output is marked deprecated.
  • Requires a 64-bit operating system and Python.
  • Scan output is not legal advice.
  • Provided without warranties.

Who it suits

It suits developers and organizations that need to inspect codebases for licensing, package, dependency, or origin information. It can also fit teams that want to integrate scan results into other applications.

Verdict

ScanCode Toolkit offers varied scan targets, output formats, and integration options at no charge. Its output should be treated as informational rather than legal advice.

Where Specifiction places it

Alternatives to ScanCode ToolkitAll alternatives →