FOSSology vs licscan

FOSSology is an open-source system for examining software for license, copyright, and export-control information. Upload individual files or packages, then unpack and scan them with selected agents. Nomos looks for license indicators through phrases, regular expressions, and heuristics; Monk checks text against stored license texts or phrases supplied by users. Its web interface supports review of findings, license-text management, bulk recognition, aggregated file views, and reusing reviews for files with matching hashes. It can identify copyright statements and presents keyword-based findings that users can review for possible export-control relevance. Reports include SPDX 2.0 exports, Debian copyright files, hierarchical file lists with license identifiers, and Readme files with identified license and copyright details. A REST API supports CI/CD use, uploads, and scan triggers from other applications; the command line can retrieve SPDX files. Deployment options include Docker, Vagrant with VirtualBox, or source installation. It is free, with on-premise deployment options. One stated limit: it cannot determine which libraries produced a binary; binary analysis tools are needed for that task.

licscan is a free command-line tool for checking project dependencies for license risk and producing software bills of materials and EU CRA evidence. It supports Go, Node.js, PHP, Python, Ruby, Rust, and Java projects. Its configurable five-level risk model can deny, warn about, or allow licenses, with exceptions. Output formats include table, JSON, HTML, Markdown, CycloneDX, SPDX, CRA PDF, SARIF, and JUnit. CRA mode creates a PDF and an extended CycloneDX JSON SBOM containing manufacturer and product metadata. LicScan runs locally without an account, telemetry, backend connection, or phone-home behavior; the maker describes scans as deterministic for the same inputs. Its official GitHub Action can post verdicts on pull requests, fail builds for denied licenses, and upload SBOM artifacts. SARIF and JUnit outputs support other CI workflows. It runs on Linux, macOS, and Windows, with installation options including Homebrew, curl, and go install. The free open-source plan is listed at free, with $0 per scan and an Apache 2.0 license.