Check License Compliance vs FossID Workbench
Check License Compliance
github.com
FossID Workbench
fossid.comSide by side
| Figure | Check License Compliance | FossID Workbench |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | — | — |
| Web | — | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Open Source License Compliance Software | 8.0 (#9) | 8.2 (#6) |
| Deployment | The GitHub Action runs using a Docker image defined by the repository's Dockerfile. | FossID describes cloud, hybrid, and on-premises deployment options, including an offline air-gapped option. |
| Policy controls | Policies can allow, forbid, or warn on licenses, with configurable behavior for other or unknown licenses. | Policy management can enforce license, security, and software usage rules across projects. |
| Purpose | Checks repository dependencies against allowed, forbidden, and warning license policies. | FossID Workbench is a software composition analysis tool for identifying third-party components, licenses, and vulnerabilities in codebases. |
Plans
In their own words
Check License Compliance
Check License Compliance has no write-up on Specifiction yet; its figures are above.
FossID Workbench
FossID Workbench is a software composition analysis tool for identifying and governing third-party software in codebases. It analyzes direct and transitive dependencies, scans unmanaged source code across programming languages, and detects embedded open-source snippets, including modified code. ID Assist proposes component identifications, while License Extractor extracts file-level license text. Vulnerable Snippet Finder locates code blocks linked to CVEs, with VEX data adding exploitability context. Workbench creates, imports, consolidates, and exports software bills of materials with component, license, vulnerability, and usage information in SPDX or CycloneDX formats. Policy Management can enforce license, security, and usage rules across projects. GitHub, GitLab, and Bitbucket imports are supported, alongside CI/CD scanning, gating, pull-request notifications, and API workflows. Deployment options include cloud, hybrid, on-premises, and offline air-gapped setups. It supports many ecosystems, including JavaScript, Java/Kotlin, Python, Rust, Go, C/C++, .NET, and others. Pricing is available on request.