FossID Workbench vs ts-scan
FossID Workbench
fossid.comts-scan
trustsource.ioSide by side
| Figure | FossID Workbench | ts-scan |
|---|---|---|
| Price from | — | — |
| Free plan | — | — |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | — |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 0 |
| Spec score · Software Composition Analysis Software | 8.2 (#12) | 7.3 (#49) |
| API | The Workbench API supports custom workflows for scanning, gating, and notifying. | The product page says results can flow through a documented REST API to TrustSource or other tooling. |
| Company | FossID says it was founded in 2016 and was reacquired by its founders in 2022 after being acquired by Snyk in 2021. | TrustSource identifies itself as a brand of EACG GmbH. |
| Dependency analysis | Workbench identifies direct and transitive dependencies from supported package manifests, while source scanning can find unmanaged code. | ts-scan analyzes native lockfiles and build configurations to find direct and transitive dependencies. |
| Headquarters | Stockholm, Sweden | Frankfurt am Main, Germany |
| Intended users | FossID describes its tools for engineering, DevSecOps, compliance, legal, and audit teams, and says it is trusted by enterprise software teams. | The maker describes ts-scan as an open-source CLI scanner for use in CI/CD pipelines to identify dependencies and create SBOMs. |
| Purpose | FossID Workbench is a software composition analysis tool for identifying third-party components, licenses, and vulnerabilities in codebases. | ts-scan scans software dependencies and generates a software bill of materials (SBOM). |
Plans
In their own words
FossID Workbench
FossID Workbench is a software composition analysis tool for identifying and governing third-party software in codebases. It analyzes direct and transitive dependencies, scans unmanaged source code across programming languages, and detects embedded open-source snippets, including modified code. ID Assist proposes component identifications, while License Extractor extracts file-level license text. Vulnerable Snippet Finder locates code blocks linked to CVEs, with VEX data adding exploitability context. Workbench creates, imports, consolidates, and exports software bills of materials with component, license, vulnerability, and usage information in SPDX or CycloneDX formats. Policy Management can enforce license, security, and usage rules across projects. GitHub, GitLab, and Bitbucket imports are supported, alongside CI/CD scanning, gating, pull-request notifications, and API workflows. Deployment options include cloud, hybrid, on-premises, and offline air-gapped setups. It supports many ecosystems, including JavaScript, Java/Kotlin, Python, Rust, Go, C/C++, .NET, and others. Pricing is available on request.