FOSSA

FOSSA is a software composition analysis platform for teams that must connect dependency, license, vulnerability, and SBOM work to delivery controls. It suits developers, security groups, and legal reviewers sharing one policy workflow. The main trade-off is that its useful breadth comes with tightly bounded Free limits and a Quick Import mode that is less thorough than CLI scanning.

Overview

FOSSA analyzes open-source dependencies across the software lifecycle, covering more than 30 languages and a broad set of ecosystems including JavaScript/TypeScript, Java/Kotlin, Python, Go, Ruby, Rust, Clojure, Elixir, iOS/Objective-C/Swift, .NET, PHP, Dart, Erlang, Fortran, Haskell, and Perl. Its policy engine applies organization-wide license, security, and quality rules, with build-blocking enforcement. That makes it appropriate for teams that need controls in the release path, rather than only an occasional inventory.

Scanning is available through the CLI and CI/CD, with container analysis, snippet detection, Quick Import from code hosts, and enterprise uploads for binaries and SBOMs. Quick Import scans source without running the build, so its results are less complete than a CLI scan; teams making release or compliance decisions should use the CLI when possible.

FOSSA generates, imports, exports, and manages SBOMs, and provides reachability analysis and pull-request scanning. Integrations include Jira, GitHub, Slack, Bitbucket, GitLab, APIs, and OIDC providers. Its Trust Center lists SOC 2 compliance, data encryption, and penetration-testing controls.

Key features

Policy and analysis

Dependency analysis, license rules, security checks, quality checks, reachability analysis, and pull-request scanning cover both engineering and governance needs. Build blocking can prevent non-compliant changes from progressing, which is valuable for organizations with formal approval requirements.

SBOM workflows

SBOM generation and import/export support lets teams keep inventories alongside scans. Free users can import five SBOMs, while higher tiers provide broader capacity. Enterprise binary and SBOM uploads extend the workflow beyond source repositories.

Integrations and security

Connections to issue tracking, source-control, chat, APIs, and OIDC providers help place findings in existing processes. SOC 2, encryption, and penetration-testing controls are documented for organizations evaluating security posture.

Pricing

FOSSA uses a freemium model. The Free plan costs nothing, billed Free forever, and includes five projects, 10 contributing developers, one release group, five dependency levels for scans, one quality check, five imported SBOMs, and basic email support. It is a credible starting point for a small codebase, but the project, depth, quality-check, and SBOM caps make it unsuitable for a growing portfolio without moving up.

Business is listed at $2,020,710 a year, billed annually, and includes 10 projects / SBOM imports, 10 contributing developers, one release group, unlimited dependency levels, the full suite of quality checks, and priority support. The expanded scan depth and checks fit teams formalizing governance, although the single release group and 10-developer limit still constrain larger organizations. FOSSA also advertises paid plans from 20 /mo (annual).

Enterprise uses custom pricing. It adds unlimited projects, a custom developer count, unlimited release groups and dependency levels, enterprise SLAs, and custom retention policies.

Platforms

FOSSA offers web, API, Linux, and self-hosted deployment options, with a hybrid deployment model. Customers can operate the on-premises edition in their own infrastructure using Kubernetes and Helm, which suits organizations with deployment or data-residency requirements.

Who it's for

Choose FOSSA if developers, security teams, and legal counsel need a shared system for dependency risk, licensing, policy enforcement, and SBOM operations. It is especially suitable when CI/CD gates, pull-request checks, reachability analysis, or self-hosting matter. A small team wanting only a quick, occasional scan may find the broader workflow and usage caps unnecessary.

Pros and cons

• Pro: Organization-wide policies can block builds, turning findings into enforceable release rules.
• Pro: CLI, CI/CD, container, snippet, SBOM, and binary workflows cover varied development inputs.
• Pro: Self-hosted Kubernetes and Helm deployment supports infrastructure-controlled operation.
• Con: Free is capped at five projects, 10 contributing developers, five dependency levels, one quality check, and five imported SBOMs.
• Con: Quick Import is less complete than CLI scanning because it does not run the build.
• Con: Business retains a 10-project / SBOM-import, 10-developer, and one-release-group ceiling.

Alternatives

For repository and component hosting with CI/CD integration, consider Sonatype Nexus Repository; its Community Edition is free and supports full ecosystem coverage, CI/CD integration, and an external PostgreSQL option.

Interlynk is a fit when a forever-free community tier with no per-seat fees or per-SBOM metering is the priority.

Choose sbomify for a free community setup centered on one product, five components, unlimited SBOMs and compliance documents, and public documents.

CAST SBOM Manager is an alternative when a free Linux or Windows download is sufficient.

Exodos Labs suits teams wanting unlimited inventories in its free community plan, with one user and one API key.

Ortelius offers a free, self-hosted-oriented option capped at five components with unlimited users and endpoint tracking.

Consider OTNOS SBOM 360 for a free plan with 50 monitored assets and daily monitoring.

ReARM is another option for a free, self-hosted community edition with core SBOM/XBOM storage and retrieval.

For broader category browsing, see SBOM Management Software, Dependency Management Software, Open Source License Compliance Software, and Software Composition Analysis Software.

Verdict

FOSSA is a strong choice for organizations that need dependency scanning tied to enforceable policy, SBOM management, and multiple deployment paths. Its main reason to look elsewhere is scale or simplicity: Free and Business impose firm quotas, and teams wanting only lightweight scanning may not need the surrounding governance system.