FOSSology
What it is
FOSSology is a free, open-source system and toolkit for examining software for license, copyright, and export-control information. Users can upload files or packages, unpack them, and scan them with selected agents. Nomos looks for license indicators using phrases, regular expressions, and heuristics; Monk compares text with stored license texts or phrases users define. Its web interface supports reviewing findings, managing license texts, bulk recognition, aggregated file views, and reusing reviews for files with matching hashes. FOSSology can find copyright statements and surface keyword findings that may relate to export-control codes for review. It generates SPDX 2.0 exports, Debian copyright files, hierarchical file lists with license identifiers, and Readme files containing identified license and copyright details. A REST API supports CI/CD integration, package uploads, and scan triggering from other applications; the command line can retrieve SPDX files. Deployment options include Docker, Vagrant with VirtualBox, or installation from source. The project offers voluntary community support through its mailing list and GitHub issues. It cannot determine which libraries were used to create a binary.
For and against
For
- Free, open-source license-compliance toolkit.
- Scans files or packages with selected agents.
- Produces SPDX 2.0 exports and other reports.
- REST API supports CI/CD integration.
- Deployment options include Docker and source installation.
Against
- Cannot identify libraries used to create a binary.
- Community support is voluntary.
The verdict
FOSSology combines scanning, review tools, reports, and automation for license-compliance work. Binary library identification is outside its stated capabilities, and support is voluntary through community channels.
Who it suits
FOSSology is intended for companies, individuals, and groups seeking to improve their ability to comply with open-source licenses. It may also suit teams that need scan automation or compliance reports.
Plans and prices
FOSSology open-source software
self-hosted deployment · no paid tiers published
Read 15 Oct 2026 · fossology.org
FOSSology
Open-source license compliance toolkit and system
Read 30 Sep 2026 · fossology.org
On the record
- Aggregated views
- Uploads can be reviewed through aggregated license-occurrence or folder-hierarchy views.fossology.org · read 15 Oct 2026
- API authentication
- API access keys can be read-only or read-write and can be invalidated or deleted if compromised.fossology.org · read 15 Oct 2026
- API documentation
- An OpenAPI description is included in the source tree and can be loaded into Swagger Editor.fossology.org · read 15 Oct 2026
- Automation and API
- The REST API supports CI/CD integration, package uploads and scan triggering from other applications, and command-line retrieval of SPDX files.fossology.org · read 30 Sep 2026
- Buckets
- Users can define bucket rules that classify files according to license-related conditions.fossology.org · read 15 Oct 2026
- Bulk recognition
- A phrase-based bulk operation can apply a license decision or correction across thousands of matching files.fossology.org · read 15 Oct 2026
- Copyright and export-control scans
- FOSSology can find copyright statements and let users review keyword-based findings that may relate to export-control codes.fossology.org · read 30 Sep 2026
- Copyright scanning
- The copyright agent searches copyright markers and authorship phrases, then presents findings for review and correction.fossology.org · read 15 Oct 2026
- Current stewardship
- The Linux Foundation began hosting FOSSology in 2015.linuxfoundation.org · read 15 Oct 2026
- Deduplication
- Hash-based reuse lets later scans reuse results and review decisions for unchanged files.github.com · read 15 Oct 2026
- Deployment
- The project describes installation using Docker, Vagrant with VirtualBox, or source installation.fossology.org · read 30 Sep 2026
- Documentation depth
- Documentation spans user workflow pages, a GitHub wiki, generated developer documentation, REST API material, installation guidance and testing information.github.com · read 15 Oct 2026
- Export-control checks
- A keyword agent supports custom regular expressions, including searches for export-control and customs statements.fossology.org · read 15 Oct 2026
- Independent praise
- A SourceForge reviewer called FOSSology important for starting an open-source governance program and described its community as helpful.sourceforge.net · read 15 Oct 2026
- Independent project description
- SourceForge describes FOSSology as modular software for license scanning, copyright and user identification, license classification and metadata extraction.sourceforge.net · read 15 Oct 2026
- Independent rating
- OpenFoundry lists FOSSology at 5 out of 5 from 2 votes.web-archive-2025.openfoundry.org · read 15 Oct 2026
- Installation options
- Official guidance provides Docker, Vagrant with VirtualBox and source installation paths.fossology.org · read 15 Oct 2026
- Intended users
- The project says its community includes companies, individuals, and groups using the toolkit or system to improve their ability to comply with open-source licenses.fossology.org · read 30 Sep 2026
