aboutcode-org/scancode-toolkit

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

2612 stars · 770 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

ScanCode Toolkit is a command-line tool and Python library that scans codebases to detect licenses, copyrights, package manifests, dependencies, and vulnerabilities in source and binary files. It produces inventories of open source and third-party packages and can generate SBOMs in SPDX and CycloneDX formats.

Use cases

• detect open source licenses in a codebase
• generate an SBOM for my project
• find copyrights and license notices in source files
• inventory third-party dependencies and packages
• check license compliance before releasing software
• generate attribution documents for used open source packages
• scan binaries and source for license and vulnerability info

When to choose

• you need accurate, best-in-class license and copyright detection across large codebases
• you want a standalone CLI that embeds easily in CI/CD pipelines
• you need SPDX or CycloneDX SBOM generation
• you run Windows, macOS, or Linux and want a heavily tested tool

When to avoid

• you need a web UI and scan project management - use the companion ScanCode.io app instead
• you only need dependency resolution for a single package manager rather than full license scanning
• you want real-time container or runtime security scanning rather than static code analysis

Facets

cli-tool · maturity active

security parser developer-tools cli developer-tools security legal windows python cli license-scanning sbom spdx cyclonedx software-composition-analysis copyright-detection open-source-compliance package-url automation linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="aboutcode-org/scancode-toolkit")