Freedom251 › Open Source License Compliance Software
ScanCode Toolkit
What ScanCode Toolkit is
ScanCode Toolkit examines codebases for code origin, copyrights, licenses, vulnerabilities, packages and dependencies. It can run as a command-line tool or as a library inside an application. For license detection, it checks extracted file text against an index of license texts and rules. Scanning can recursively unpack archives and extract text from binary files when needed, and the toolkit supports package manifests, lockfiles and other package data files. Results can be saved as JSON, YAML, JSON Lines, HTML, SPDX, Debian copyright or CycloneDX; CSV output is marked deprecated. JSON results can be used with ScanCode Workbench and other applications that accept ScanCode scan data. Plugins can extend different processing stages, and external plugins can add license data. Installation options include release archives, Docker, source, pip and Fedora’s repository. Linux, macOS and Windows are listed as tested platforms, with 64-bit operating system and Python requirements documented. ScanCode is free. Its output is provided without warranties and should not be used as legal advice.
Who it suits
It may suit developers or organizations examining codebases and dependencies for origin, license and package information. Its command-line, library, plugin and output options also suit teams integrating scan results into other applications.
What it does well
- Scans for origins, licenses, vulnerabilities and dependencies.
- Runs from the command line or as an application library.
- Exports to JSON, YAML, HTML, SPDX and other formats.
- Supports recursive archive scanning.
- Free software for Linux, macOS and Windows.
What to know first
- CSV output is marked deprecated.
- 64-bit operating system and Python requirements apply.
- Scan output is not legal advice and has no warranty.
Limits
The toolkit is free. Its documentation specifies 64-bit operating systems and Python requirements; CSV output is deprecated.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| ScanCode Toolkit | Free software code scanning tool | Free |
As scancode-toolkit.readthedocs.io lists them, read 2 Oct 2026. The maker's own page has the final word.
Getting started
- Visit the ScanCode Toolkit documentation website.
- Choose an installation route: release archive, Docker, source, pip, or Fedora’s repository.
- Check the documented 64-bit operating system and Python requirements for your platform.
- Run it as a command-line tool or use it as a library in an application.
- Choose a supported output format for scan results.
Verdict
ScanCode Toolkit provides free code scanning with several output formats and integration options. Users should account for its documented platform and Python requirements, and should not treat scan output as legal advice.
Questions
How much does ScanCode Toolkit cost?
The listed plan is 0.00 USD.
Which platforms are listed?
Linux, macOS, Windows, API, and self-hosted are listed. Linux, macOS, and Windows are documented as tested platforms.
How can it be installed?
Options include release archives, Docker, source, pip, and Fedora’s repository.
What output formats are available?
Results can be written as JSON, YAML, JSON Lines, HTML, SPDX, Debian copyright, or CycloneDX. CSV is marked deprecated.
Can ScanCode Toolkit be used in other applications?
Yes. It can run as a library, and JSON scan results can be consumed by ScanCode Workbench and other applications that accept ScanCode result data.
Is the output legal advice?
No. The output says the toolkit is provided as-is without warranties and should not be used as legal advice.
Facts from ScanCode Toolkit's own pages
- Archive scanning
- The scanning process extracts files recursively from archives and extracts text from binary files when needed. · scancode-toolkit.readthedocs.io, 2 Oct 2026
- Extensibility
- Plugins can extend ScanCode at different stages, and users can add license data through external plugins. · scancode-toolkit.readthedocs.io, 2 Oct 2026
- Founded
- 2003 · scancode-toolkit.readthedocs.io, 28 Sept 2026
- Headquarters
- Los Altos, California, United States · scancode-toolkit.readthedocs.io, 28 Sept 2026
- Installation
- Installation options include release archives, Docker, source, pip, and Fedora’s repository. · scancode-toolkit.readthedocs.io, 2 Oct 2026
- Integration
- JSON scan results can be consumed by ScanCode Workbench and other applications that accept ScanCode result data. · scancode-toolkit.readthedocs.io, 2 Oct 2026
- Legal limitation
- The scan output says ScanCode is provided as-is without warranties and that its content should not be used as legal advice. · scancode-toolkit.readthedocs.io, 2 Oct 2026
- License detection
- License detection searches an index of license texts and rules for matches in extracted file text. · scancode-toolkit.readthedocs.io, 2 Oct 2026
- Maker history
- nexB says it was founded in 2003 by Michael J. Herzog, Philippe Ombrédanne and François Granade. · nexb.com, 2 Oct 2026
- Output formats
- Scan results can be written as JSON, YAML, JSON Lines, HTML, SPDX, Debian copyright, or CycloneDX; CSV is marked deprecated. · scancode-toolkit.readthedocs.io, 2 Oct 2026
- Package support
- It supports a wide variety of package manifests, lockfiles and package datafiles containing package and dependency information. · scancode-toolkit.readthedocs.io, 2 Oct 2026
- Platform requirements
- The documentation lists Linux, macOS and Windows as tested platforms and specifies 64-bit operating systems and Python requirements. · scancode-toolkit.readthedocs.io, 2 Oct 2026
- Purpose
- ScanCode Toolkit scans codebases to detect code origin, copyrights, licenses, vulnerabilities, packages and dependencies. · scancode-toolkit.readthedocs.io, 2 Oct 2026
- Support
- The project directs users to its community Slack and GitHub discussions for questions and challenges. · scancode-toolkit.readthedocs.io, 2 Oct 2026
- Use modes
- It can be used as a command-line tool or as a library in an application. · scancode-toolkit.readthedocs.io, 2 Oct 2026