aboutcode-org/scancode-toolkit
Scancode Toolkit
ScanCode Toolkit is a software composition analysis tool and scanning framework designed to identify open-source licenses and copyright statements in source code and binary files. It functions as an open-source license detector, a dependency vulnerability scanner, and a generator for standardized software bills of materials in SPDX and CycloneDX formats.
The project is built as a plugin-based scanning framework, allowing the integration of custom detection logic, specialized analyzers, and modified scanning behaviors at runtime. It distinguishes itself through the ability to produce formal legal compliance reports and attribution documents using customizable templates.
The toolkit covers several core capability areas, including the extraction of copyright declarations through regular expressions and the resolution of transitive dependency trees from package manifests. It provides a multi-format serialization pipeline to export scan data as JSON, YAML, HTML, CSV, SPDX, or CycloneDX. Additionally, it includes security analysis capabilities to cross-reference identified dependencies against vulnerability databases.
Features
- License Detectors - Matches license texts against a curated database of known license templates using rule-based heuristics and regular expressions.
- Open Source License Detectors - Identifies open-source licenses and copyright statements in source code and binary files using a reference database.
- Open Source Compliance Scanning - Scans codebases to identify open-source licenses and copyright statements to ensure legal compliance.
- Copyright Statements - Extracts copyright statements from file contents using pattern-matching regular expressions tuned for common copyright formats.
- Copyright Extraction Tools - Extracts copyright declarations from source code, package manifests, and binary files.
- Copyright Location Tools - Locates and extracts copyright statements embedded in source code and binary files.
- Copyright Statement Detection - Identifies copyright statements and ownership information embedded within source files.
- Legal Notice Scanners - Scans source code and files to detect declared licenses and copyright statements.
- Package Manifests - Extracts dependency and version information from supported package datafiles and manifest files.
- Plugin-Based Scanning Frameworks - Functions as a framework that loads external modules at runtime to extend detection logic and output formats.
- Package Metadata Inspectors - Parses build manifests and lockfiles to collect package URLs and dependency information from various formats.
- Dependency Metadata Extraction - Identifies package manifest files and extracts dependency metadata for supported ecosystems.
- Dependency Vulnerability Scanners - Analyzes package manifests and lock files to detect known security vulnerabilities in third-party dependencies.
- License Compliance Tools - Generates attribution documents and notice files to ensure compliance with open-source license obligations.
- Software Composition Analysis Tools - Identifies third-party packages, dependencies, and licenses within a codebase to manage supply chain risks.
- Software License Identification - Automates the discovery and identification of open-source licenses and their associated text within files.
- Source Code Vulnerability Scanning - Analyzes source code and binary files to identify security vulnerabilities and legal notices.
- Package Dependency Resolution - Parses package manifests and lock files to reconstruct transitive dependency trees for software composition analysis.
- License Compliance Reports - Scans source code and dependencies to identify and report all licenses used within a project.
- Licensing Information - Detects and reports licenses, copyrights, and other policy-relevant information across files and packages.
- Software Bill of Materials Generators - Generates comprehensive software bills of materials in standardized formats like SPDX and CycloneDX.
- Third-Party Component Inventories - Detects and catalogs third-party packages and their dependencies within a codebase for analysis.
- Report Generation - Produces formal attribution reports based on scan results to document all identified third-party software and licenses.
- Regex Extraction Utilities - Uses tuned regular expressions to extract copyright statements and legal notices from files.
- Document Generation Templates - Populates customizable templates with scan results to generate formal license compliance reports.
- Template-Based Reports - Generates attribution documents by filling scan results into customizable templates for license compliance reporting.
- Scan Result Exporters - Writes scan output as JSON, HTML, CSV, or SPDX documents for integration with other tools.
- Analysis Result Exporters - Serializes analysis results into standardized JSON, SPDX, or CycloneDX formats for external integration.
- Multi-Format Serializers - Transforms internal scan data into multiple standard interchange formats including JSON, YAML, SPDX, and CycloneDX.
- Custom Detection Logic - Provides a mechanism to integrate custom detection logic and specialized detectors to handle specific file types or legal policies.
- Detection Rule Refinement - Integrates custom plugins and rules at various process stages to refine detection accuracy and modify output.
- License Index Management - Manages license definitions and installs external license sets to improve detection accuracy.
- Parallel Directory Scanning - Uses multi-threading to accelerate the processing and analysis of large directory trees.
- Programmable Scan Interfaces - Provides a programmable interface to automate scanning workflows and retrieve results.
- Scanning Behavior Customization - Allows the injection of custom logic into different stages of the scanning process to modify detection behavior.
- Plugin Extensibility - Implements a plugin-based architecture to extend scanning capabilities with third-party detectors and output formats at runtime.
- Dependency Vulnerability Scanning - Scans package manifests and dependency files to detect known security vulnerabilities using databases.
- Security Vulnerability Scanning - Analyzes files to detect known security vulnerabilities within the codebase.
- Vulnerability Scanners - Analyzes files and package manifests to detect known security vulnerabilities within the codebase.
- Rule Customization - Allows the addition of new license rules and external definitions to refine the identification process.
- Detection Plugin Interfaces - Provides a plugin architecture to integrate custom detection logic for licenses, packages, and files.
- Vulnerability Analysis - Detects known security vulnerabilities in code, packages, and dependencies within a codebase.
- Multi-Format Exporters - Transforms scan results into multiple formats like JSON, SPDX, and CycloneDX through a configurable pipeline.
- Multithreaded File Scanning - Implements multithreaded file system traversal to accelerate the analysis of large source code repositories.
