aboutcode-org/scancode-toolkit

Features

• License Detectors - Matches license texts against a curated database of known license templates using rule-based heuristics and regular expressions.
• Open Source License Detectors - Identifies open-source licenses and copyright statements in source code and binary files using a reference database.
• Open Source Compliance Scanning - Scans codebases to identify open-source licenses and copyright statements to ensure legal compliance.
• Copyright Statements - Extracts copyright statements from file contents using pattern-matching regular expressions tuned for common copyright formats.
• Copyright Extraction Tools - Extracts copyright declarations from source code, package manifests, and binary files.
• Copyright Location Tools - Locates and extracts copyright statements embedded in source code and binary files.
• Copyright Statement Detection - Identifies copyright statements and ownership information embedded within source files.
• Legal Notice Scanners - Scans source code and files to detect declared licenses and copyright statements.
• Package Manifests - Extracts dependency and version information from supported package datafiles and manifest files.
• Plugin-Based Scanning Frameworks - Functions as a framework that loads external modules at runtime to extend detection logic and output formats.
• Package Metadata Inspectors - Parses build manifests and lockfiles to collect package URLs and dependency information from various formats.
• Dependency Metadata Extraction - Identifies package manifest files and extracts dependency metadata for supported ecosystems.
• Dependency Vulnerability Scanners - Analyzes package manifests and lock files to detect known security vulnerabilities in third-party dependencies.
• License Compliance Tools - Generates attribution documents and notice files to ensure compliance with open-source license obligations.
• Software Composition Analysis Tools - Identifies third-party packages, dependencies, and licenses within a codebase to manage supply chain risks.
• Software License Identification - Automates the discovery and identification of open-source licenses and their associated text within files.
• Source Code Vulnerability Scanning - Analyzes source code and binary files to identify security vulnerabilities and legal notices.
• Package Dependency Resolution - Parses package manifests and lock files to reconstruct transitive dependency trees for software composition analysis.
• License Compliance Reports - Scans source code and dependencies to identify and report all licenses used within a project.
• Licensing Information - Detects and reports licenses, copyrights, and other policy-relevant information across files and packages.
• Software Bill of Materials Generators - Generates comprehensive software bills of materials in standardized formats like SPDX and CycloneDX.
• Third-Party Component Inventories - Detects and catalogs third-party packages and their dependencies within a codebase for analysis.
• Report Generation - Produces formal attribution reports based on scan results to document all identified third-party software and licenses.
• Regex Extraction Utilities - Uses tuned regular expressions to extract copyright statements and legal notices from files.
• Document Generation Templates - Populates customizable templates with scan results to generate formal license compliance reports.
• Template-Based Reports - Generates attribution documents by filling scan results into customizable templates for license compliance reporting.
• Scan Result Exporters - Writes scan output as JSON, HTML, CSV, or SPDX documents for integration with other tools.
• Analysis Result Exporters - Serializes analysis results into standardized JSON, SPDX, or CycloneDX formats for external integration.
• Multi-Format Serializers - Transforms internal scan data into multiple standard interchange formats including JSON, YAML, SPDX, and CycloneDX.
• Custom Detection Logic - Provides a mechanism to integrate custom detection logic and specialized detectors to handle specific file types or legal policies.
• Detection Rule Refinement - Integrates custom plugins and rules at various process stages to refine detection accuracy and modify output.
• License Index Management - Manages license definitions and installs external license sets to improve detection accuracy.
• Parallel Directory Scanning - Uses multi-threading to accelerate the processing and analysis of large directory trees.
• Programmable Scan Interfaces - Provides a programmable interface to automate scanning workflows and retrieve results.
• Scanning Behavior Customization - Allows the injection of custom logic into different stages of the scanning process to modify detection behavior.
• Plugin Extensibility - Implements a plugin-based architecture to extend scanning capabilities with third-party detectors and output formats at runtime.
• Dependency Vulnerability Scanning - Scans package manifests and dependency files to detect known security vulnerabilities using databases.
• Security Vulnerability Scanning - Analyzes files to detect known security vulnerabilities within the codebase.
• Vulnerability Scanners - Analyzes files and package manifests to detect known security vulnerabilities within the codebase.
• Rule Customization - Allows the addition of new license rules and external definitions to refine the identification process.
• Detection Plugin Interfaces - Provides a plugin architecture to integrate custom detection logic for licenses, packages, and files.
• Vulnerability Analysis - Detects known security vulnerabilities in code, packages, and dependencies within a codebase.
• Multi-Format Exporters - Transforms scan results into multiple formats like JSON, SPDX, and CycloneDX through a configurable pipeline.
• Multithreaded File Scanning - Implements multithreaded file system traversal to accelerate the analysis of large source code repositories.

Star history