FossID Workbench vs MergeBase
FossID Workbench
fossid.com
MergeBase
mergebase.comSide by side
| Figure | FossID Workbench | MergeBase |
|---|---|---|
| Price from | — | $38/mo |
| Free plan | — | — |
| Free trial | — | Yes |
| Open source | — | — |
| Web | Yes | Yes |
| Linux | Yes | — |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 3 |
| Spec score · Software Composition Analysis Software | 8.2 (#12) | 8.1 (#16) |
| Deployment | FossID describes cloud, hybrid, and on-premises deployment options, including an offline air-gapped option. | The Enterprise tier lists an on-prem option to run MergeBase in a private cloud or data center. |
| Founded | 2016 | 2018 |
| Product | FossID Workbench is a software composition analysis tool for identifying and governing third-party software in codebases. | MergeBase is a software composition analysis platform for finding and managing vulnerable open-source components in applications. |
| SBOM | Workbench can create SBOMs with component, license, vulnerability, and usage information and export them in SPDX or CycloneDX formats. | The platform generates Software Bill of Materials reports and offers SBOM support for source projects. |
| Support | FossID directs customers to its support portal for help and ticket submission. | The Team and Business tiers list email support, while Enterprise lists dedicated support. |
Plans
In their own words
FossID Workbench
FossID Workbench is a software composition analysis tool for identifying and governing third-party software in codebases. It analyzes direct and transitive dependencies, scans unmanaged source code across programming languages, and detects embedded open-source snippets, including modified code. ID Assist proposes component identifications, while License Extractor extracts file-level license text. Vulnerable Snippet Finder locates code blocks linked to CVEs, with VEX data adding exploitability context. Workbench creates, imports, consolidates, and exports software bills of materials with component, license, vulnerability, and usage information in SPDX or CycloneDX formats. Policy Management can enforce license, security, and usage rules across projects. GitHub, GitLab, and Bitbucket imports are supported, alongside CI/CD scanning, gating, pull-request notifications, and API workflows. Deployment options include cloud, hybrid, on-premises, and offline air-gapped setups. It supports many ecosystems, including JavaScript, Java/Kotlin, Python, Rust, Go, C/C++, .NET, and others. Pricing is available on request.