FOSSology vs ScanCode Toolkit

FOSSology is an open-source system for examining software for license, copyright, and export-control information. Upload individual files or packages, then unpack and scan them with selected agents. Nomos looks for license indicators through phrases, regular expressions, and heuristics; Monk checks text against stored license texts or phrases supplied by users. Its web interface supports review of findings, license-text management, bulk recognition, aggregated file views, and reusing reviews for files with matching hashes. It can identify copyright statements and presents keyword-based findings that users can review for possible export-control relevance. Reports include SPDX 2.0 exports, Debian copyright files, hierarchical file lists with license identifiers, and Readme files with identified license and copyright details. A REST API supports CI/CD use, uploads, and scan triggers from other applications; the command line can retrieve SPDX files. Deployment options include Docker, Vagrant with VirtualBox, or source installation. It is free, with on-premise deployment options. One stated limit: it cannot determine which libraries produced a binary; binary analysis tools are needed for that task.

ScanCode Toolkit is a free tool for scanning codebases for origin, copyrights, licenses, vulnerabilities, packages, and dependencies. It can run as a command-line tool or as a library within an application. Its license detection compares text extracted from files with an index of license texts and rules. Scanning can recursively unpack archives and extract text from binary files when needed, while package support covers manifests, lockfiles, and package datafiles. Results can be saved as JSON, YAML, JSON Lines, HTML, SPDX, Debian copyright, or CycloneDX; CSV is marked deprecated. JSON results can feed ScanCode Workbench and other applications that accept ScanCode data. Plugins extend processing stages, and external plugins can add license data. Installation options include release archives, Docker, source, pip, and Fedora’s repository. Linux, macOS, and Windows are listed as tested platforms, with 64-bit operating system and Python requirements. The project points users to community Slack and GitHub discussions for help; scan output is provided without warranties and is not legal advice.