Freedom251 › Open Source License Compliance Software
SBOM Workbench
What SBOM Workbench is
SBOM Workbench is a graphical tool for scanning and auditing source code through the SCANOSS API. It identifies open-source components, including undeclared code that may be absent from dependency manifests. The free Workbench can identify open-source licenses and security vulnerabilities, and it generates SPDX-Lite software bills of materials. Release notes also list exports in CycloneDX, SPDX Lite, CSV, and HTML. The developer-oriented tool runs on Linux, macOS, and Windows. Its CLI can be configured to use multiple SCANOSS API endpoints, including custom servers, and its integrations include pre-commit hooks, Actions, pipelines, and webhooks. Bitbucket is marked as coming soon. Repository documentation describes a collaborative workspace, and v1.19.0 added JSON raw-results import and project import with source-code inclusion. Cryptographic algorithm identification is a premium feature, not part of the free Workbench. The Workbench itself is free to download; prices listed for broader SCANOSS subscriptions are not Workbench prices. SCANOSS provides support by email.
Who it suits
SBOM Workbench suits developers who want a graphical interface for scanning and auditing source code, including for undeclared components, licenses, and vulnerabilities. It may also suit teams needing multiple API endpoints or a collaborative workspace.
What it does well
- Free to download on Linux, macOS, and Windows.
- Finds components missing from dependency manifests.
- Identifies licenses and security vulnerabilities.
- Exports include CycloneDX, SPDX Lite, CSV, and HTML.
- CLI supports multiple API endpoints, including custom servers.
What to know first
- Cryptographic algorithm identification requires the premium version.
- Bitbucket integration is marked as coming soon.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| SBOM Workbench | Free download · advanced cryptographic detection is a premium feature | Free |
As scanoss.readthedocs.io lists them, read 7 Oct 2026. The maker's own page has the final word.
Verdict
SBOM Workbench covers component discovery, license and vulnerability identification, and several SBOM export formats in a free graphical tool. Cryptographic algorithm identification is reserved for the premium version, while paid subscription prices listed for broader SCANOSS offerings are not Workbench prices.
Facts from SBOM Workbench's own pages
- API configuration
- The Workbench CLI can configure multiple SCANOSS API endpoints, including custom servers. · github.com, 7 Oct 2026
- Collaboration
- The Workbench repository documents support for a collaborative workspace. · github.com, 7 Oct 2026
- Headquarters
- Madrid, Spain · scanoss.readthedocs.io, 28 Sept 2026
- Imports
- Workbench v1.19.0 added JSON raw-results import and project import with source-code inclusion. · scanoss.com, 7 Oct 2026
- Integrations
- The maker lists pre-commit hooks, Actions, pipelines and webhooks among its integrations; Bitbucket is marked coming soon. · scanoss.com, 7 Oct 2026
- Intended users
- The maker describes the Workbench as a developer-oriented graphical tool for scanning and auditing source code. · github.com, 7 Oct 2026
- Open source
- SCANOSS says its distributed software is open source, and the Workbench has a public GitHub repository. · scanoss.com, 7 Oct 2026
- Premium feature
- The maker says cryptographic algorithm identification is available in the premium version. · scanoss.com, 7 Oct 2026
- Pricing context
- The maker’s pricing page lists paid SCANOSS subscriptions from € 35K / yr for small dev teams and € 53K / yr for medium dev teams, with enterprise pricing custom; these are not stated as Workbench prices. · scanoss.com, 7 Oct 2026
- Purpose
- SBOM Workbench is a graphical interface for scanning and auditing source code using the SCANOSS API. · github.com, 7 Oct 2026
- SBOM output
- The Workbench generates SPDX-Lite SBOMs, and its release notes list exports including CycloneDX, SPDX Lite, CSV and HTML. · scanoss.com, 7 Oct 2026
- Security findings
- The free Workbench identifies open-source licenses and security vulnerabilities in code. · scanoss.com, 7 Oct 2026
- Source scanning
- It identifies open-source components, including undeclared code that may not appear in dependency manifests. · docs.scanoss.com, 7 Oct 2026
- Support
- SCANOSS directs users to contact its support team by email at [email protected]. · scanoss.com, 7 Oct 2026