OpossumUI review
A local review workspace for turning scanner results into attribution and SPDX outputs.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
OpossumUI is an open-source desktop application for auditing and inventorying open-source components in codebases. It is designed for compliance teams and developers who need to review scanner findings, inspect license and copyright evidence, refine attribution data, and prepare component or legal-review documents. The application runs locally on Windows, macOS, and Linux, making it suited to workflows that keep compliance review on a desktop or on-premise environment rather than in a hosted service.
Its strongest capability is the way it brings scanner output into an attribution review workflow. OpossumUI imports ScanCode JSON and OWASP Dependency-Check JSON files, combines findings from multiple analysis tools, and lets reviewers browse scanner evidence alongside codebase file trees. File or group attributions can be created and edited within the application, which gives teams a focused workspace for resolving attribution details after analysis. Integration with OSS Review Toolkit, ScanCode, and OWASP Dependency-Check also places it within an existing open-source compliance toolchain.
The export options make OpossumUI useful beyond inspection. It produces SPDX documents in JSON and YAML, compact and detailed component-list CSV files, and follow-up documents for legal review. However, it is a review tool rather than a source-scanning system: the workflow begins with imported scanner results. It also focuses on attribution, evidence, inventory, and reporting instead of policy enforcement or obligation tracking. Choose OpossumUI when local desktop review and editable attribution records are the priority; choose a broader compliance system when scanning, policy controls, or obligation management need to be handled in the same product.
OpossumUI pros and cons
- Where it wins
- Combines ScanCode and OWASP Dependency-Check findings
- Edits file or group attributions with evidence and codebase browsing
- Exports SPDX, component-list CSV, and legal follow-up documents
- Where it doesn't
- Does not perform source scans itself
- Relies on imported scanner result files
- Focuses on review rather than policy enforcement or obligation tracking
OpossumUI fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update