FOSSA vs licscan

FOSSA scans software projects for dependencies, vulnerabilities, and license issues across the development lifecycle. Its open-source dependency analysis covers more than 30 languages, and its policy engine can enforce organization-wide license, security, and quality requirements, including build-blocking rules. Teams can generate, import, export, and manage software bills of materials (SBOMs). Scanning options include CLI and CI/CD workflows, container analysis, snippet detection, Quick Import from code hosts, and enterprise binary and SBOM uploads. Quick Import scans source without running the build, so its results are less complete than a CLI scan. Documented integrations include Jira, GitHub, Slack, Bitbucket, GitLab, APIs, and OIDC providers. FOSSA offers web, Linux, API, and self-hosted options; customers can operate its on-premises deployment using Kubernetes and Helm. Free includes five projects, 10 contributing developers, and five imported SBOMs. Business is listed at $2,020,710 a year; Enterprise pricing is custom and not listed.

licscan is a free command-line tool for checking project dependencies for license risk and producing software bills of materials and EU CRA evidence. It supports Go, Node.js, PHP, Python, Ruby, Rust, and Java projects. Its configurable five-level risk model can deny, warn about, or allow licenses, with exceptions. Output formats include table, JSON, HTML, Markdown, CycloneDX, SPDX, CRA PDF, SARIF, and JUnit. CRA mode creates a PDF and an extended CycloneDX JSON SBOM containing manufacturer and product metadata. LicScan runs locally without an account, telemetry, backend connection, or phone-home behavior; the maker describes scans as deterministic for the same inputs. Its official GitHub Action can post verdicts on pull requests, fail builds for denied licenses, and upload SBOM artifacts. SARIF and JUnit outputs support other CI workflows. It runs on Linux, macOS, and Windows, with installation options including Homebrew, curl, and go install. The free open-source plan is listed at free, with $0 per scan and an Apache 2.0 license.