FOSSA vs ScanCode.io
FOSSA
fossa.comScanCode.io
scancode.ioSide by side
| Figure | FOSSA | ScanCode.io |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 3 | 1 |
| Spec score · Open Source License Compliance Software | 8.1 (#8) | 8.4 (#5) |
| Spec score · Software Composition Analysis Software | 8.0 (#20) | 8.4 (#8) |
| Deployment | FOSSA documents an on-premises deployment that customers can operate in their own infrastructure using Kubernetes and Helm. | ScanCode.io can run in a Docker container or be installed on a Linux server. |
| Founded | 2015 | 2014 |
| Headquarters | San Francisco, California, United States | Brussels, Belgium |
| Purpose | FOSSA scans software to identify dependencies, vulnerabilities, and license issues across the software development lifecycle. | ScanCode.io provides a Web UI and API for running and reviewing complex software composition analysis scans in scripted pipelines. |
| SBOMs | FOSSA supports generating, importing, exporting, and managing SBOMs; the pricing page lists a limit of five imported SBOMs on Free. | It supports generating and consuming CycloneDX and SPDX SBOMs. |
| Support | The Free plan includes basic email support, while Business includes priority support. | The documentation directs users to file documentation issues for missing or confusing content. |
Plans
In their own words
FOSSA
FOSSA scans software projects for dependencies, vulnerabilities, and license issues across the development lifecycle. Its open-source dependency analysis covers more than 30 languages, and its policy engine can enforce organization-wide license, security, and quality requirements, including build-blocking rules. Teams can generate, import, export, and manage software bills of materials (SBOMs). Scanning options include CLI and CI/CD workflows, container analysis, snippet detection, Quick Import from code hosts, and enterprise binary and SBOM uploads. Quick Import scans source without running the build, so its results are less complete than a CLI scan. Documented integrations include Jira, GitHub, Slack, Bitbucket, GitLab, APIs, and OIDC providers. FOSSA offers web, Linux, API, and self-hosted options; customers can operate its on-premises deployment using Kubernetes and Helm. Free includes five projects, 10 contributing developers, and five imported SBOMs. Business is listed at $2,020,710 a year; Enterprise pricing is custom and not listed.
ScanCode.io
ScanCode.io provides a web interface and API for running software composition analysis scans in scripted pipelines. It scans containers, Docker images, package archives, and manifests for license, copyright, source, and vulnerability information, and can generate or consume CycloneDX and SPDX SBOMs. The same capabilities are available through its command-line interface and REST API. Documented pipeline integrations include GitHub Actions, Jenkins, GitLab, and Azure Pipelines; other CI/CD systems that support Docker can run it too. It can fetch packages using Package URLs and retrieve artifacts from JFrog Artifactory and Sonatype Nexus. Installation is preferably through Docker, including for Windows; Linux server installation is also supported, and an offline Docker package can be transferred to an isolated server. The software is open source under Apache License 2.0 and is free. Authentication for the web interface and API is disabled by default, but can be enabled. Its default setup starts one worker, so it runs one pipeline at a time.