CheckOps home

Tools directory

F

CheckOps

FOSSA

FOSSA is a software supply-chain platform for SBOM generation, software composition analysis, open-source licence compliance and vulnerability management, with a free plan.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

FOSSA secures the software supply chain with automated SBOM generation, software composition analysis, licence compliance and vulnerability management. It is particularly known for open-source licence compliance and attribution reports.

Features

  1. Licence compliance: Policies and attribution reports.
  2. SCA: Vulnerability detection in dependencies.
  3. SBOM: Generate and manage SBOMs.
  4. CLI: fossa-cli for CI integration.
  5. Policy engine: Define allowed licences.

Pros

Cons

  1. Per-project pricing: Costs scale with projects.
  2. Limits on free plan: 5 projects and 10 contributing developers.
curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install-latest.sh | bash
fossa analyze && fossa test

Resources:

Pricing

From FOSSA’s pricing page: a free plan for 5 projects and 10 contributing developers; paid plans from $20 per project per month, billed annually.

  1. Companies managing open-source licence obligations.
  2. Teams needing SBOMs for customers.
  3. Not a fit for SAST.

Conclusion

FOSSA is a strong choice for licence compliance and SBOM-driven SCA.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with FOSSA side by side.