OSI-licensed open source
An open-source license manager helps an organisation keep track of which third-party licences its software depends on, whether they conflict with how you distribute your product, and what obligations such as attribution apply. It is about managing licences you consume, not issuing licence keys to customers.
This page covers organisation-level tools: servers and workflows that scan, inventory and approve licences across many projects. Developer-side command-line checkers are on our open-source software licensing tools page. Every tool here is open source, with licences read from its repository on 2026-11-07. We could only list six because other candidates had licences we could not verify.
Tools, licences and pricing checked against vendor and repository pages on November 7, 2026.
| Tool | Best for | Pricing | Licence |
|---|---|---|---|
| FOSSology | Legal and compliance review of source trees | Free, open source (self-hosted) | GPL-2.0 |
| ScanCode Toolkit | Accurate licence detection in CI or ad-hoc audits | Free, open source | Apache-2.0 |
| ScanCode.io | Pipeline-driven SCA with a web UI | Free, open source | Apache-2.0 |
| Dependency-Track | SBOM-based portfolio tracking | Free, open source | Apache-2.0 |
| OSS Review Toolkit (ORT) | Policy-as-code licence checks | Free, open source | Apache-2.0 |
| LicenseFinder | Approval workflow for dependency licences | Free, open source | MIT |
Best for: Legal and compliance review of source trees · Free, open source (self-hosted)
FOSSology is a licence compliance toolkit and web system that runs licence, copyright and export-control scans and supports a compliance workflow.
Best for: Accurate licence detection in CI or ad-hoc audits · Free, open source
ScanCode Toolkit is a command-line tool and library that detects licences, copyrights, package dependencies and vulnerabilities in code. Output formats include JSON, YAML, HTML, CycloneDX and SPDX.
Best for: Pipeline-driven SCA with a web UI · Free, open source
ScanCode.io is a server for scripting and automating software composition analysis through pipelines. It is the web companion to ScanCode Toolkit.
Best for: SBOM-based portfolio tracking · Free, open source
Dependency-Track is a component analysis platform that uses SBOM data to find and reduce supply-chain risk. It tracks components and their licences across your portfolio.
Best for: Policy-as-code licence checks · Free, open source
ORT is a suite of tools to automate software compliance checks. It is built for analysing dependencies and enforcing policy in CI.
Best for: Approval workflow for dependency licences · Free, open source
LicenseFinder scans a project's package managers to identify dependency licences and flags those that need approval against a policy you define.
One email a week with the tools, launches and releases added to TechLogHub. Unsubscribe in one click.
One email a week: new and trending developer tools, fresh comparisons, and what shipped. Unsubscribe in one click.
| If you need… | Start with |
|---|---|
| Legal review workflow for source trees | FOSSology |
| Highest-detail licence and copyright detection | ScanCode Toolkit |
| Server-based scanning pipelines | ScanCode.io |
| Portfolio view driven by SBOMs | Dependency-Track |
| Policy checks in CI | OSS Review Toolkit or LicenseFinder |
Quick answers to common questions
It inventories the licences of your dependencies, flags conflicts with policy and tracks obligations.
No. This page is about licences you consume. Tools that generate keys for your customers are a different category.
Not strictly, but SBOM formats such as SPDX and CycloneDX make it easier to move data between tools like ScanCode and Dependency-Track.
No. They detect and report; humans decide whether a licence is acceptable for your use.
List it on TechLogHub and we'll review it for this guide.
