FOSSA vs ScanCode Toolkit

FOSSA scans software projects for dependencies, vulnerabilities, and license issues across the development lifecycle. Its open-source dependency analysis covers more than 30 languages, and its policy engine can enforce organization-wide license, security, and quality requirements, including build-blocking rules. Teams can generate, import, export, and manage software bills of materials (SBOMs). Scanning options include CLI and CI/CD workflows, container analysis, snippet detection, Quick Import from code hosts, and enterprise binary and SBOM uploads. Quick Import scans source without running the build, so its results are less complete than a CLI scan. Documented integrations include Jira, GitHub, Slack, Bitbucket, GitLab, APIs, and OIDC providers. FOSSA offers web, Linux, API, and self-hosted options; customers can operate its on-premises deployment using Kubernetes and Helm. Free includes five projects, 10 contributing developers, and five imported SBOMs. Business is listed at $2,020,710 a year; Enterprise pricing is custom and not listed.

ScanCode Toolkit is a free tool for scanning codebases for origin, copyrights, licenses, vulnerabilities, packages, and dependencies. It can run as a command-line tool or as a library within an application. Its license detection compares text extracted from files with an index of license texts and rules. Scanning can recursively unpack archives and extract text from binary files when needed, while package support covers manifests, lockfiles, and package datafiles. Results can be saved as JSON, YAML, JSON Lines, HTML, SPDX, Debian copyright, or CycloneDX; CSV is marked deprecated. JSON results can feed ScanCode Workbench and other applications that accept ScanCode data. Plugins extend processing stages, and external plugins can add license data. Installation options include release archives, Docker, source, pip, and Fedora’s repository. Linux, macOS, and Windows are listed as tested platforms, with 64-bit operating system and Python requirements. The project points users to community Slack and GitHub discussions for help; scan output is provided without warranties and is not legal advice.