scancode-toolkit

What it is and what it does

ScanCode Toolkit is a production-grade code scanning tool that identifies licenses, copyrights, package manifests, and dependencies across source and binary files. It performs full-text comparison against a database of license texts rather than relying on regex patterns alone, and is used by hundreds of software teams including the Eclipse Foundation, FSFE, and FSF. The toolkit runs as both a command-line tool and an embeddable library, with support for Windows, macOS, and Linux.

The package outputs scan results in multiple formats (JSON, YAML, HTML, CycloneDX, SPDX) and can be extended via plugins for custom scanners and parsers. It includes support for parsing package manifests and lockfiles to extract Package URLs and metadata. The project is actively maintained, heavily tested with over 30,000 tests per commit, and backed by European Commission NGI funding.

Use it for:

• Generate software bill of materials (SBOM) in SPDX or CycloneDX format for compliance and supply-chain transparency.
• Scan open-source dependencies and third-party code to identify license obligations before integration.
• Integrate into CI/CD pipelines to enforce license policies and detect copyright notices automatically.
• Extract package metadata and dependencies from manifests and lockfiles for dependency tracking.
• Audit binary packages and compiled artifacts for embedded licenses and copyright information.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

ScanCode Toolkit detects licenses, copyrights, package metadata, and dependencies in source code and binary files, and outputs results in multiple formats including JSON, YAML, HTML, CycloneDX, and SPDX.

Yes. ScanCode Toolkit is a mature, actively maintained tool with no known vulnerabilities, low install friction, and permissive licensing. It is the reference implementation for code scanning depth and accuracy, widely adopted by major organizations. Install it if you need license detection, copyright extraction, or SBOM generation; the 50 runtime dependencies are standard utilities and the command-line interface is straightforward to integrate into existing workflows.

Install

scancode-toolkit on PyPI

pip install scancode-toolkit

uv add scancode-toolkit

poetry add scancode-toolkit

Installing scancode-toolkit

Before you install

Low install friction with wheels available for Python 3.10 through 3.14. Active maintenance with last commit on 2026-08-07 and 2602 repository stars. Depends on 50 runtime packages including common utilities like click, lxml, and jinja2, but no compiled system dependencies are evident from the wheel availability.

License in practice

Licensed under Apache-2.0 with CC-BY-4.0 for reference datasets and multiple secondary permissive or copyleft licenses for third-party components. Permissive overall treatment allows commercial and proprietary use, though you should review the NOTICE file and .ABOUT files for third-party attribution obligations.

Quickstart

pip install scancode-toolkit

from scancode.cli import main
main(['--license', '--copyright', '/path/to/code'])

Requires Python 3.10 or later; the package is designed primarily as a command-line tool, so library usage patterns may require consulting the documentation.

Verify before relying

• Whether the package's 50 runtime dependencies introduce significant disk or memory overhead in production environments.
• Performance characteristics when scanning very large codebases or binary files.
• Accuracy of license detection compared to other SCA tools in your specific use case.

Package facts

Evidence: scancode_toolkit-32.5.0-cp310-none-any.whl; scancode_toolkit-32.5.0-cp311-none-any.whl; scancode_toolkit-32.5.0-cp312-none-any.whl; scancode_toolkit-32.5.0-cp313-none-any.whl; scancode_toolkit-32.5.0-cp314-none-any.whl

Keywords: open source, scan, license, package, dependency, copyright, filetype, author, extract, licensing, scan, sca, SBOM, spdx, cyclonedx

Tags

More Software Development packages