ScanCode Toolkit is an open-source tool for finding software provenance and license information in source code, binaries, packages, and package manifests. The Q3 2019 overview describes copyright detection using natural-language processing and license matching using automatons, inverted indexes, and multi-diffs. Current project documentation also describes package, dependency, and vulnerability detection, with command-line and Python-library use.
What is ScanCode Toolkit?
ScanCode Toolkit is a software-composition analysis engine: it examines a codebase to identify where software may have come from and what license and copyright information it contains. The Q3 2019 overview frames its purpose as identifying software origin and license from code. The current project describes a broader set of detections that includes copyrights, vulnerabilities, packages, and dependencies. ScanCode Toolkit project repository
It is primarily a command-line toolkit and Python library, rather than a hosted web application. The current project lists Windows, macOS, and Linux support. The project ecosystem also includes ScanCode.io, a web-based automation and pipeline environment, and DejaCode, an enterprise open-source license-compliance application powered by ScanCode; these are separate offerings, not features established by the 2019 overview. nexB
How does ScanCode detect licenses and copyrights?
License matching
The Q3 2019 overview attributes license detection to automatons, inverted indexes, and multi-diffs. In practical terms, the scanner compares text it finds in software against license rules and samples. Its data-driven approach draws on collections of license texts and notices, and the public rules repository allows detection data to be improved by adding or correcting rules and samples rather than changing scanner code. ScanCode Toolkit documentation Scan a codebase
#1 Best Overall
Copyright parsing
The 2019 overview describes copyright detection as natural-language processing. Current documentation explains that ScanCode parses copyright statements found in text, binary content, and structured package manifests. A detection is an extracted statement for review; it should not be treated by itself as a legal conclusion about ownership or compliance. ScanCode FAQ
Files, archives, and packages
The documented pipeline inventories and classifies files, can extract archives and binary text when needed, applies license rules, parses copyright statements, and identifies package metadata. Scanning package manifests helps surface declared package information alongside findings from files. The project also describes package and dependency detection, but the cited overview and documentation do not establish a universal detection rate for every language, package ecosystem, or binary format. Scan a codebase ScanCode FAQ
Rank #2
What output formats does ScanCode produce?
The Q3 2019 overview lists JSON, CSV, SPDX, and other formats. Current project documentation additionally lists YAML, HTML, and CycloneDX. JSON is useful for programmatic processing, while HTML can make results easier to inspect; SPDX and CycloneDX support interchange with software-composition and compliance workflows. Format availability depends on the version and command being used, so consult the documentation for the installed release before building an integration. ScanCode Toolkit project repository ScanCode Toolkit documentation
Can ScanCode scan packages and dependencies?
Yes. ScanCode detects package metadata and can report packages and dependencies, in addition to scanning files for license and copyright information. The distinction matters: a package manifest may declare a dependency, while file-level scanning can find license or copyright evidence in the package’s contents. Using both types of evidence gives reviewers more context than relying on either manifest data or text matching alone. ScanCode.io adds web-based automation and pipeline capabilities; it is a separate companion environment rather than the Toolkit itself. ScanCode Toolkit project repository nexB
Free tools Windows power users keep installed
One-click scans. No signup required.
How does ScanCode fit alongside other compliance tools?
ScanCode Toolkit is a local, command-line and library-oriented engine that can feed results into other workflows. FOSSology is a separate open-source license-compliance system and toolkit; it provides command-line scanning as well as a database and web workflow, and supports SPDX and attribution outputs. A useful comparison should focus on what matters for the intended workflow rather than treating the products as interchangeable.
- Detection coverage: Which file types, license notices, package metadata, and dependency sources are relevant to your codebase?
- Transparency and extensibility: Can reviewers inspect and improve the rules or samples behind detections?
- Integration: Do the available output formats fit existing reporting, inventory, or compliance processes?
- Deployment: Do you need a local toolkit, a web-based automation pipeline, or an enterprise application?
FOSSology’s command-line and database/web options make it a useful point of comparison, but the available information here does not establish a performance ranking between it and ScanCode. FOSSology
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the Q3 2019 overview does—and does not—establish
The 2019 overview is a snapshot of the Toolkit’s stated approach and outputs at that time. It highlights NLP for copyright parsing, rule- and index-based license detection, public rules and samples, and formats including JSON, CSV, and SPDX. Current documentation describes additional capabilities and formats, but those should not be retroactively attributed to the 2019 slide deck. The available sources do not provide a dated performance statistic or a named-person quotation, so no numeric accuracy or speed claim can be responsibly made from this material.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →
