ScanCode.io vs SW360
ScanCode.io
scancode.ioSW360
eclipse.devSide by side
| Figure | ScanCode.io | SW360 |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Open Source License Compliance Software | 8.4 (#5) | 7.4 (#23) |
| Deployment | ScanCode.io can run in a Docker container or be installed on a Linux server. | The recommended SW360 v20 deployment uses containers compatible with Docker or Podman and includes the frontend, Keycloak, CouchDB, and Spring Boot backend. |
| Founded | 2014 | 2016 |
| License | The ScanCode.io software is licensed under Apache License 2.0. | The project is open source and licensed under EPL-2.0. |
| Purpose | ScanCode.io provides a Web UI and API for running and reviewing complex software composition analysis scans in scripted pipelines. | SW360 is a software catalogue and repository for collecting, organizing, and sharing information about software components used in an organization. |
| SBOMs | It supports generating and consuming CycloneDX and SPDX SBOMs. | The user guide lists Software Bill of Materials management as a use case. |
| Security configuration | Authentication for the Web UI and REST API is disabled by default and can be enabled with SCANCODEIO_REQUIRE_AUTHENTICATION. | The security guide recommends TLS with trusted certificates, secret management, and restricting bearer-token validation to trusted issuers. |
Plans
In their own words
ScanCode.io
ScanCode.io provides a web interface and API for running software composition analysis scans in scripted pipelines. It scans containers, Docker images, package archives, and manifests for license, copyright, source, and vulnerability information, and can generate or consume CycloneDX and SPDX SBOMs. The same capabilities are available through its command-line interface and REST API. Documented pipeline integrations include GitHub Actions, Jenkins, GitLab, and Azure Pipelines; other CI/CD systems that support Docker can run it too. It can fetch packages using Package URLs and retrieve artifacts from JFrog Artifactory and Sonatype Nexus. Installation is preferably through Docker, including for Windows; Linux server installation is also supported, and an offline Docker package can be transferred to an isolated server. The software is open source under Apache License 2.0 and is free. Authentication for the web interface and API is disabled by default, but can be enabled. Its default setup starts one worker, so it runs one pipeline at a time.
SW360
SW360 is an open-source catalogue and repository for organizing software component information across an organization. It records components, releases, and projects, manages license information and obligations, and supports workflows that produce license-related documents. Software Bill of Materials management is listed as a use case, with SPDX RDF/XML and CycloneDX import formats. SW360 also collects vulnerability information and matches it with components in its component service. A REST API exposes its functions, with documented HTTP Basic, API token, OAuth2, and Keycloak authentication options. The recommended version 20 deployment uses Docker- or Podman-compatible containers for the frontend, Keycloak, CouchDB, and Spring Boot backend. SW360 can trigger FOSSology clearing and import its reports, while FOSSology performs license scanning. SW360 itself does not scan licenses or source code. The project is free, licensed under EPL-2.0, and designed for self-managed deployment. Version 20.1.0 is listed as dated July 29, 2026.