Apache RAT vs ScanCode Toolkit
Apache RAT
creadur.apache.orgScanCode Toolkit
scancode-toolkit.readthedocs.ioSide by side
| Figure | Apache RAT | ScanCode Toolkit |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Open Source License Compliance Software | 8.5 (#3) | 7.7 (#14) |
| Extensibility | Users can add license definitions through XML, and can extend matchers, definition formats, reports, and user interfaces with the relevant expertise. | Plugins can extend ScanCode at different stages, and users can add license data through external plugins. |
| Output formats | The package includes stylesheets for missing-header reports, unapproved-license reports, plain output, and pretty-printed XML. | Scan results can be written as JSON, YAML, JSON Lines, HTML, SPDX, Debian copyright, or CycloneDX; CSV is marked deprecated. |
| Purpose | Apache RAT audits software distributions, with a focus on license headers. | ScanCode Toolkit scans codebases to detect code origin, copyrights, licenses, vulnerabilities, packages and dependencies. |
| Support | The project invites users to contribute patches, report bugs, and talk to the community. | The project directs users to its community Slack and GitHub discussions for questions and challenges. |
Plans
In their own words
Apache RAT
Apache RAT is a free, open-source release-audit tool for checking software distributions, with particular attention to license headers. Version 0.18 provides a command-line client, an Ant task library, and a Maven plugin. You can include or exclude files using patterns, collections, pattern files, and file-size limits; apply approved-license lists; and produce plain, XML, missing-header, or unapproved-license reports. The Maven plugin can write target/rat.txt or add a report to a generated site. RAT can add Apache-2.0 headers and copyright notices to files allowed by configuration. XML license definitions are supported, and experienced users can extend matchers, formats, reports, and interfaces. It runs on Linux and is intended for self-hosted, on-premise use. Building requires Java 17, with Maven 3.9.13 or later recommended. Reports need interpretation and project-specific tuning, and heuristics can miss issues.
ScanCode Toolkit
ScanCode Toolkit is a free tool for scanning codebases for origin, copyrights, licenses, vulnerabilities, packages, and dependencies. It can run as a command-line tool or as a library within an application. Its license detection compares text extracted from files with an index of license texts and rules. Scanning can recursively unpack archives and extract text from binary files when needed, while package support covers manifests, lockfiles, and package datafiles. Results can be saved as JSON, YAML, JSON Lines, HTML, SPDX, Debian copyright, or CycloneDX; CSV is marked deprecated. JSON results can feed ScanCode Workbench and other applications that accept ScanCode data. Plugins extend processing stages, and external plugins can add license data. Installation options include release archives, Docker, source, pip, and Fedora’s repository. Linux, macOS, and Windows are listed as tested platforms, with 64-bit operating system and Python requirements. The project points users to community Slack and GitHub discussions for help; scan output is provided without warranties and is not legal advice.