OpenSCA vs ScanCode.io

OpenSCA analyzes software components and dependencies for vulnerabilities and open-source license risks. It can be used through an IDE, command line or cloud platform, with online and offline use described. The CLI is available for Windows, Linux and macOS, and documented package ecosystems cover Java, JavaScript, PHP, Ruby, Go, Rust, Erlang and Python. OpenSCA generates SBOMs in DSDX, SPDX, CycloneDX and SWID formats; it can also take an SBOM as input to create a vulnerability report or convert formats. CLI report formats include JSON, XML, HTML, SQLite, CSV and SARIF. Its cloud vulnerability database covers CVE, CWE, NVD, CNVD and CNNVD, and configurable local databases and private package repositories are supported. Xcheck plugins are documented for IntelliJ IDEA and VS Code, and pull request scanning is supported. The free plan costs nothing. Parsing requirements.txt and requirements.in requires a pipenv environment and an internet connection.

ScanCode.io provides a web interface and API for running software composition analysis scans in scripted pipelines. It scans containers, Docker images, package archives, and manifests for license, copyright, source, and vulnerability information, and can generate or consume CycloneDX and SPDX SBOMs. The same capabilities are available through its command-line interface and REST API. Documented pipeline integrations include GitHub Actions, Jenkins, GitLab, and Azure Pipelines; other CI/CD systems that support Docker can run it too. It can fetch packages using Package URLs and retrieve artifacts from JFrog Artifactory and Sonatype Nexus. Installation is preferably through Docker, including for Windows; Linux server installation is also supported, and an offline Docker package can be transferred to an isolated server. The software is open source under Apache License 2.0 and is free. Authentication for the web interface and API is disabled by default, but can be enabled. Its default setup starts one worker, so it runs one pipeline at a time.