FossID Workbench

What FossID Workbench is

FossID Workbench is a software composition analysis tool for identifying and governing third-party components, licenses, and vulnerabilities in codebases. It analyzes direct and transitive dependencies from supported package manifests and can scan unmanaged source code, including embedded open-source snippets and modified code. ID Assist proposes component matches, while License Extractor finds file-level license text. Vulnerable Snippet Finder locates code blocks associated with CVEs, with VEX data adding exploitability context. Workbench can create, import, consolidate, and export software bills of materials containing component, license, vulnerability, and usage details in SPDX or CycloneDX formats. Policy Management applies license, security, and usage rules across projects. It connects with GitHub, GitLab, and Bitbucket, and CI/CD workflows can scan, gate, and notify on pull requests. Deployment options include cloud, hybrid, on-premises, and offline air-gapped use. FossID says fingerprint-based scanning allows findings to be reviewed without source code leaving the team's infrastructure. The paid product is available on web and Linux, with pricing on request.