FOSSA vs OSSKB

FOSSA scans software projects for dependencies, vulnerabilities, and license issues across the development lifecycle. Its open-source dependency analysis covers more than 30 languages, and its policy engine can enforce organization-wide license, security, and quality requirements, including build-blocking rules. Teams can generate, import, export, and manage software bills of materials (SBOMs). Scanning options include CLI and CI/CD workflows, container analysis, snippet detection, Quick Import from code hosts, and enterprise binary and SBOM uploads. Quick Import scans source without running the build, so its results are less complete than a CLI scan. Documented integrations include Jira, GitHub, Slack, Bitbucket, GitLab, APIs, and OIDC providers. FOSSA offers web, Linux, API, and self-hosted options; customers can operate its on-premises deployment using Kubernetes and Helm. Free includes five projects, 10 contributing developers, and five imported SBOMs. Business is listed at $2,020,710 a year; Enterprise pricing is custom and not listed.

OSSKB identifies open source software in source code, including at the snippet level, to provide information relevant to license compliance. It matches source-code fingerprints against a database of fingerprints for known open source software. Results may include license names, copyright statements, quality indicators, and vulnerability information. The web service also offers API access, a Python scanner, and Audit Workbench downloads for macOS Intel, macOS M1/M2, and Linux; a compatible CLI or webhook can support automation. OSSKB is powered by the Open Source Software Knowledge Base, created and maintained by SCANOSS. It is free of charge on a best-effort basis, with no guarantee of availability or performance. The provider may limit the number or frequency of transactions to help maintain availability and performance. Fingerprint matching can produce false positives and false negatives, so results need human assessment. The terms say usage information may be logged to monitor load and improve the service, and that OSSKB is designed for professional use rather than end consumers. The listed plan is free.