ScanCode Toolkit examines codebases for code origin, copyrights, licenses, vulnerabilities, packages and dependencies. It can run as a command-line tool or as a library inside an application. For license detection, it checks extracted file text against an index of license texts and rules. Scanning can recursively unpack archives and extract text from binary files when needed, and the toolkit supports package manifests, lockfiles and other package data files. Results can be saved as JSON, YAML, JSON Lines, HTML, SPDX, Debian copyright or CycloneDX; CSV output is marked deprecated. JSON results can be used with ScanCode Workbench and other applications that accept ScanCode scan data. Plugins can extend different processing stages, and external plugins can add license data. Installation options include release archives, Docker, source, pip and Fedora’s repository. Linux, macOS and Windows are listed as tested platforms, with 64-bit operating system and Python requirements documented. ScanCode is free. Its output is provided without warranties and should not be used as legal advice.
Who it is for
It may suit developers or organizations examining codebases and dependencies for origin, license and package information. Its command-line, library, plugin and output options also suit teams integrating scan results into other applications.
What is good
- Scans for origins, licenses, vulnerabilities and dependencies.
- Runs from the command line or as an application library.
- Exports to JSON, YAML, HTML, SPDX and other formats.
- Supports recursive archive scanning.
- Free software for Linux, macOS and Windows.
What to know first
- CSV output is marked deprecated.
- 64-bit operating system and Python requirements apply.
- Scan output is not legal advice and has no warranty.
Verdict
ScanCode Toolkit provides free code scanning with several output formats and integration options. Users should account for its documented platform and Python requirements, and should not treat scan output as legal advice.
ScanCode Toolkit plans and pricing
All plansCompared on open source license compliance software
- Free plan
- Yes
- Policy enforcement
- advisory
- Attribution reports
- Yes
- Deployment options
- on-premise
- Source scan methods
- multiple
