cloudparts

FOSSA

A hosted service that lists every open-source dependency in your code and containers, checks their licences against a policy you set and their versions against known vulnerabilities, and produces SBOMs and attribution reports.

What it is
Common Vulnerabilities and Exposures (CVE)
Used for
Package managers
Type
Commercial product
Made by
FOSSA, Inc.
License
Proprietary service; the fossa CLI is CPAL-1.0
Facts checked
24 October 2026
Website Source code

What it is

FOSSA is software composition analysis (SCA): it works out which third-party packages a product contains, then asks two questions of each one, “are we allowed to ship this licence?” and “does this version have a known vulnerability?”. The scanning starts with the open-source fossa CLI. Run fossa analyze in a project and it finds the projects under the directory, asks their build tools or lockfiles for the dependency graph, infers the project name, branch and revision from Git, and uploads the graph to FOSSA. It gives the best results inside a working build, where it can ask the build tool for the exact dependencies instead of inferring them from the source. fossa container analyze does the same for a container image, and fossa sbom analyze imports an SPDX or CycloneDX file someone else produced.

On the server the dependencies are matched against licence and vulnerability data and checked against policies. A licensing policy has three kinds of rule: Deny raises a Policy Conflict issue that has to be resolved before the project passes, Flag for Review raises an issue a person must approve or reject, and Approve suppresses issues for that licence or dependency. FOSSA ships three templates, Standard Bundle Distribution, Single-Binary Distribution and Website/Hosted Service, because the same licence can be fine for a hosted service and a problem in a shipped binary; new projects get Standard Bundle Distribution unless you choose another. In CI, fossa test waits for the scan and exits with code 1 if it raised any licence or vulnerability issue, and --diff <revision> reports only issues that are new since, say, the last release.

Around that core the product has grown: SBOM export and management, snippet scanning for copied code fragments, binary composition analysis for compiled artifacts, and fossabot, an AI agent that proposes and reviews dependency upgrades in GitHub pull requests and GitLab merge requests (in public preview from October 2025). The Free plan covers 5 projects and 10 contributing developers; Business costs $20 per project per month, and Enterprise adds SSO, role-based access and custom deployment options. FOSSA, Inc. is an independent company, founded by Kevin Wang, that bought the developer-tools community StackShare in August 2024.

Why teams pick it

  • Licence compliance is the core, not an add-on: policies per distribution model, a review queue for flagged licences, and attribution reports for what you ship
  • The CLI understands many build tools and lockfiles and needs no configuration to start; the same binary scans repositories, container images and imported SBOMs
  • fossa test turns the scan into a CI gate with an exit code, and --diff keeps old, accepted issues from failing every build
  • Imports SPDX and CycloneDX SBOMs as well as exporting its own, so suppliers’ components can be checked against the same policies

Watch out for

  • Analysis happens in FOSSA’s cloud: the CLI only collects the dependency graph, so every scan needs an API key and network access; custom deployment options are Enterprise-only
  • Results depend on the build: outside a working build the CLI infers dependencies from source, which can miss or misidentify them
  • Priced per project, and the Free plan stops at 5 projects and 10 contributing developers; snippet scanning is a separate add-on
  • Some CLI features are tied to the plan: uploading SBOMs with fossa sbom requires an Enterprise subscription

How it fits with other technologies

A CI step: scan, then fail the build on new issues · bash

# FOSSA_API_KEY comes from the CI secret store
curl -H 'Cache-Control: no-cache' \
  https://raw.githubusercontent.com/fossas/fossa-cli/master/install-latest.sh | bash

fossa analyze                      # find projects, upload dependency graphs
fossa test --diff v2.0.0           # exit 1 only on issues new since v2.0.0
fossa container analyze myapp:1.4  # scan a container image too

See it in a real stack

No architecture uses FOSSA yet. Drop it into the playground and wire it up yourself.Open playground →
Where it came from2017–2025

Almost every product ships open-source code, and each package comes with a licence whose obligations depend on how you distribute it: a copyleft licence that is harmless in a hosted service can force source disclosure in a shipped binary. Tracking that by hand across thousands of transitive dependencies doesn’t work. Kevin Wang launched FOSSA in 2017 as a tool for developers to track the open source in their own programs, and then turned it toward enterprises; in 2019 he told TechCrunch there was “no tooling out there that can manage the scale and breadth across all the different enterprise use cases”.

The open-source CLI reached 1.0.0 in August 2019, and the company raised an $8.5 million Series A led by Bain Capital Ventures that September. In October 2020 it closed a $23.2 million Series B, bringing its total to $35 million, and launched FOSSA Security Management, adding vulnerability scanning to licence compliance; it counted more than 90 million open-source scans and more than 80 enterprise contracts. Version 3.0.0 of the CLI followed in November 2021.

Since then FOSSA has added SBOM management, snippet and binary scanning, and moved toward dependency upgrades. In August 2024 it bought StackShare, a site where developers share the tools they use, and pointed to the 2021 Codecov breach as an example of the risk hidden in developer tooling. Building on its acquisition of EdgeBit, it launched fossabot in October 2025, an AI agent that researches an upgrade, assesses its impact and adapts code in a pull request.

Why it’s built this way

An open-source CLI that runs inside your build
The build tool knows the real dependency graph, including transitive versions. Running fossa analyze where the project builds lets FOSSA ask it directly instead of guessing from source files, and only the graph is uploaded.
Policies as approve, flag and deny rules
Licence decisions are a legal judgment that differs by product. Encoding them once as rules, with templates per distribution model, applies the same standard to every project and scan, and routes only unclear cases to a person.
A CI exit code rather than a dashboard alone
fossa test exits 1 when a scan raises issues, so a denied licence or a vulnerable version blocks the merge like a failing test; --diff limits that to issues introduced since a given revision.

Timeline

  1. 2017

    FOSSA launches as a developer tool, with a $2.2 million seed round

  2. 2019

    CLI 1.0.0 (August 2); $8.5 million Series A led by Bain Capital Ventures (September 16)

  3. 2020

    $23.2 million Series B and launch of FOSSA Security Management (October 15)

  4. 2021

    CLI 3.0.0 released (November 13)

  5. 2024

    Acquires StackShare (August 1)

  6. 2025

    fossabot, an AI agent for dependency updates, enters public preview (October 1)

Sources9 · facts checked 24 October 2026

Improve this page on GitHub