FOSSA

FOSSA is a software analysis platform for finding open-source dependencies, license issues, and vulnerabilities across development workflows. It suits teams that need policy controls and SBOM management alongside scanning, rather than a standalone license scanner. Its Free plan makes a bounded start possible, but its project and developer caps call for close attention as use expands.

Overview

FOSSA combines dependency analysis with license, security, and quality policy enforcement. It supports more than 30 languages, and its policy engine can apply organization-wide standards and block builds when they are not met. That makes it a stronger fit for teams integrating checks into delivery workflows than for users who only need an occasional scan.

Scanning options include CLI and CI/CD workflows, container analysis, snippet detection, Quick Import from code hosts, and enterprise binary and SBOM uploads. Quick Import is convenient for a first look, but it scans source without running the build and yields less complete results than a CLI scan. Teams making release or compliance decisions should favor the fuller CLI route where practical.

FOSSA can generate, import, export, and manage SBOMs, and supports reachability analysis and pull request scanning. Integrations include Jira, GitHub, Slack, Bitbucket, GitLab, APIs, and OIDC providers. Its Trust Center lists SOC 2 compliance, data encryption, and penetration testing controls. An on-premises deployment can run in customer infrastructure using Kubernetes and Helm, useful for organizations that need that operational model but prepared to manage it.

Key features

• Dependency and vulnerability analysis: Coverage across a broad set of language ecosystems gives development and security teams one place to examine dependencies. The source facts identify support for JavaScript/TypeScript, Java/Kotlin, Python, Go, Ruby, Rust, Clojure, Elixir, iOS/Objective-C/Swift, .NET, PHP, Dart, Erlang, Fortran, Haskell, and Perl.
• Policy enforcement: Organization-wide license, security, and quality rules, including build-blocking checks, suit teams that want findings to affect delivery rather than remain advisory.
• SBOM workflows: Creating and managing SBOMs is a core capability, though Free allows only five imported SBOMs. That cap matters for teams consolidating inventories from existing projects.
• Scanning choices: CLI and CI/CD scanning offer a more complete route than Quick Import; container and snippet analysis broaden the ways teams can inspect software.

Pricing

FOSSA uses a freemium model: Free is billed free forever, and paid pricing starts at $20/mo (annual). The stated entry price should not be confused with the separately shown Business plan amount; confirm the applicable paid offer before committing.

A free trial is offered. Free's single release group and one quality check are meaningful constraints for teams managing multiple release streams or enforcing several policies. Business still limits contributing developers to 10 and project/SBOM imports to 10; Enterprise is the route for unlimited projects and release groups.

Platforms

FOSSA supports API, Linux, self-hosted, and web access. The hybrid deployment option and documented Kubernetes-and-Helm on-premises setup give infrastructure-conscious organizations an alternative to a purely hosted workflow.

Who it's for

FOSSA is aimed at developers, security teams, and legal counsel working together on open-source risk and software inventory. It is particularly suitable where teams need build-integrated policy enforcement, SBOM handling, and cross-functional visibility. A small team with one project may find Free adequate; larger programs should assess the fixed Business caps and whether Enterprise terms are warranted.

Pros and cons

• Pro: Multiple scan modes, policy enforcement, and SBOM workflows bring related software analysis tasks together.
• Pro: Build-blocking rules can turn organization-wide license, security, and quality requirements into release controls.
• Pro: On-premises deployment and a broad integration set accommodate varied engineering environments.
• Con: Quick Import is less complete than CLI scanning because it does not run the build.
• Con: Free's project, developer, release-group, dependency-depth, quality-check, and SBOM-import caps narrow its usefulness beyond a small workload.
• Con: Business remains limited to 10 contributing developers and 10 projects / SBOM imports, so growing teams may need custom-priced Enterprise.

Alternatives

For a category-wide comparison, see Open Source License Compliance Software, SBOM Management Software, Software Composition Analysis Software, and Dependency Management Software.

• OSS Review Toolkit is a free open-source toolkit for Linux, macOS, self-hosted, and Windows use; choose it when a free toolkit is preferable to FOSSA's capped hosted plans.
• FOSSology is a free open-source license compliance toolkit and system across API, Linux, macOS, self-hosted, web, and Windows.
• Double Open Compliance offers a freemium SaaS tier and API, self-hosted, and web platforms.
• licscan is a free Apache 2.0 standalone CLI with $0 per scan, suited to users seeking a simple command-line option.
• OHRisk is a free MIT-licensed open-source CLI for Linux, macOS, and Windows.
• DejaCode offers a free plan and trial, with API, Linux, self-hosted, and web platforms.
• SourceTrust has a free option for eligible public GitHub repositories, with fair-use limits and attribution, and a $29 a month project plan; choose it when that public-repository scope fits.
• ScanCode Toolkit is a free software code-scanning tool for API, Linux, macOS, self-hosted, and Windows use.

Verdict

Choose FOSSA if your team needs dependency, license, vulnerability, and SBOM work tied to enforceable development policies. Its range of scanning methods and deployment options is compelling for coordinated engineering and compliance workflows. Look elsewhere if you need an uncapped free tool, or if the Quick Import scan is all you can run but its reduced completeness is not enough for your decisions.