FossID Workbench vs ScanCode Toolkit

FossID Workbench is a software composition analysis tool for identifying and governing third-party software in codebases. It analyzes direct and transitive dependencies, scans unmanaged source code across programming languages, and detects embedded open-source snippets, including modified code. ID Assist proposes component identifications, while License Extractor extracts file-level license text. Vulnerable Snippet Finder locates code blocks linked to CVEs, with VEX data adding exploitability context. Workbench creates, imports, consolidates, and exports software bills of materials with component, license, vulnerability, and usage information in SPDX or CycloneDX formats. Policy Management can enforce license, security, and usage rules across projects. GitHub, GitLab, and Bitbucket imports are supported, alongside CI/CD scanning, gating, pull-request notifications, and API workflows. Deployment options include cloud, hybrid, on-premises, and offline air-gapped setups. It supports many ecosystems, including JavaScript, Java/Kotlin, Python, Rust, Go, C/C++, .NET, and others. Pricing is available on request.

ScanCode Toolkit is a free tool for scanning codebases for origin, copyrights, licenses, vulnerabilities, packages, and dependencies. It can run as a command-line tool or as a library within an application. Its license detection compares text extracted from files with an index of license texts and rules. Scanning can recursively unpack archives and extract text from binary files when needed, while package support covers manifests, lockfiles, and package datafiles. Results can be saved as JSON, YAML, JSON Lines, HTML, SPDX, Debian copyright, or CycloneDX; CSV is marked deprecated. JSON results can feed ScanCode Workbench and other applications that accept ScanCode data. Plugins extend processing stages, and external plugins can add license data. Installation options include release archives, Docker, source, pip, and Fedora’s repository. Linux, macOS, and Windows are listed as tested platforms, with 64-bit operating system and Python requirements. The project points users to community Slack and GitHub discussions for help; scan output is provided without warranties and is not legal advice.