FOSSA
FOSSA: A mature SCA platform covering dependencies, SBOMs, containers, licenses, and policy controls. Ranked #2 of 65 in Software Composition Analysis Software by our editors (9.3/10); pricing: Free plan; best for hybrid teams needing mature SCA.
At a glance
- Editor score9.3 / 10
- PricingFree plan
- Best forHybrid teams needing mature SCA
- Free planYes
- Paid from$20/site/mo
- SBOM generationYes
- Founded2015 · San Francisco, California, United States
- Facts checked22 Sep 2026
Where it wins
- Direct, transitive, and reachability analysis for dependencies
- SBOM generation, import, export, and management
- Broad CI/CD, source-control, container, and policy capabilities
Where it doesn't
- Free plan is limited to 5 projects
- Business includes 10 projects or SBOM imports
- Business pricing is billed annually
Our verdict on FOSSA
FOSSA is a software supply chain security and compliance platform for engineering, security, and legal teams. It analyzes direct and transitive open-source dependencies, identifies license and vulnerability issues, generates and manages SBOMs, and supports policy enforcement and remediation workflows. Its coverage suits teams that need software composition analysis across application dependencies, container images, source repositories, and development pipelines rather than a tool limited to one scanning workflow.
The published plans offer a useful entry path. The Free plan costs $0 forever and includes 5 projects, 10 contributing developers, container scanning, API access, and SBOM export. Business costs $20 per project per month when billed annually and adds automated license and vulnerability scanning, unlimited dependency levels, multi-project reporting, and 10 projects or SBOM imports. Enterprise adds unlimited projects, a custom developer count, custom deployment options, SSO, and role-based access controls. This structure makes Free suitable for smaller evaluations and Business a clearer fit for teams that need broader project coverage and reporting.
FOSSA connects with GitHub, GitLab, Bitbucket, Azure Repos, CI/CD pipelines, and its API, with CLI and pull-request scanning available for development workflows. It supports web, Windows, macOS, Linux, API, and self-hosted deployments, while Enterprise customers can deploy on premises. The feature set spans vulnerability and license scanning, reachability analysis, container scanning, vendored code and snippet detection, merge gating, quality checks, and policy enforcement. Teams seeking dependency, SBOM, container, and compliance coverage in one platform should consider FOSSA; teams needing only a narrow dependency scanner may find this scope broader than necessary.
Your product? Our editors can test FOSSA in depth and publish a review, labelled as paid · from $149/mo →
FOSSA pricing
All 3 FOSSA plans and prices →
FOSSA fact sheet
| Free plan | Yes |
|---|---|
| Paid from | $20/site/mo |
| Supported ecosystems | JavaScript/TypeScript, Java/Kotlin, Python, Go, Ruby, Rust, Clojure, Elixir, iOS/Objective-C/Swift, .NET, PHP, Dart, Erlang, Fortran, Haskell, Perl |
| SBOM generation | Yes |
| Reachability analysis | Yes |
| Pull request scanning | Yes |
| Monitored projects | 10 projects |
| Deployment options | Hybrid |
| Deployment | Cloud, Self-hosted |
| Platforms | Web |
| Compliance & security | SOC 2, SSO/SAML, 2FA |
| Support | Email, Docs |
| Built for | Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 7 integrations: GitHub, GitLab, Bitbucket, Azure Repos, Jira, Slack … |
| Pricing | Free plan (source) |
| Website | fossa.com |
| Facts checked | 22 Sep 2026 |
FOSSA integrations
FOSSA lists 7 integrations on its own site.
- GitHub
- GitLab
- Bitbucket
- Azure Repos
- Jira
- Slack
- REST API
Alternatives to FOSSA
- Snyk Open SourceBroad SCA coverage with reachability, SBOMs, pull-request scanning, and monitoring.9.4
- Safeguard SCAA budget-conscious SCA platform with reachability analysis, SBOMs, and remediation workflows.9.1
- Black Duck SCABroad SCA coverage for enterprises managing open-source risk across the SDLC.8.9
FOSSA vs the competition
- FOSSA vs Snyk Open Source
- FOSSA vs Safeguard SCA
- FOSSA vs Black Duck SCA
- FOSSA vs Endor Labs
- FOSSA vs Semgrep Supply Chain
- FOSSA vs Socket
Compare FOSSA with any tool side by side →
Also Ranked In
FOSSA is ranked in 5 of our directories.
Used FOSSA? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used FOSSA for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
FOSSA is listed in our Software Composition Analysis Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/fossa/"><img src="https://www.itechguides.com/best/badge/fossa.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update