Release week. Somebody asks a basic question about the build. Which third-party code sits inside it? No clean answer comes back. Direct dependencies get documented, more or less. Transitive ones pile up with every update, though. Package metadata rots in lockfiles for months. Then security tries to score vulnerabilities against a list that stopped matching reality a while ago. Software Composition Analysis exists for this exact mess, and the tools have grown specific enough that a wrong pick costs real time.
SCA connects two jobs that teams often run apart: tracking licenses and producing a Software Bill of Materials. A bare list of libraries tells you almost nothing. Versions matter. So does origin, and what each license actually obliges you to do. CycloneDX and SPDX have become the common exchange formats here. One tool hands data to another without a human retyping anything. The five products below take noticeably different routes through inventory work and risk management:
- Aikido Security: dependency analysis, license risk review, and exportable SBOMs in one place;
- SCANOSS: detection of third-party code, including components and undeclared fragments;
- TrustSource: license obligation management and audit documentation;
- ScanCode.io: file-level analysis of what a software product contains;
- Xygeni: open-source package risk monitoring and supply chain control.
What follows does not count advertised features. It looks at how each tool handles dependencies, licenses, and reporting when real work starts.
1. Aikido Security: Where Dependency Risk Meets the Software Inventory
Aikido Security handles dependency analysis, license risk assessment, and SBOM generation in one place.
The scanner walks through direct and transitive dependencies. Aikido Security puts known vulnerabilities next to the licensing characteristics of each component. That pairing matters more than it sounds. Transitive packages arrive without anyone choosing them deliberately. A build can quietly carry a library nobody on the team has ever heard of. Aikido keeps all of this inside one analysis process. No scattering across a vulnerability scanner, a spreadsheet, and a separate license checker.
License handling gets its own layer. The report surfaces licenses that deserve a closer look. Risk levels get assigned. Material for compliance review gets prepared. Component inventories export to CycloneDX and SPDX. Legal interpretation of what those licenses require stays with the lawyers. That part never belonged to the tool anyway.
A few workflow elements help a team move from dependency discovery to audit-ready data:
- Dependency assessment across direct and transitive packages, with linked vulnerabilities;
- License risk review that flags terms needing a second look;
- SBOM export in CycloneDX and SPDX;
- Configurable reporting for filtering, grouping, and exporting license and risk data.
Aikido fits teams that want one current picture of technical and licensing risk, not several inventories to reconcile.
2. SCANOSS: The Code That Dependency Files Leave Out
SCANOSS identifies third-party code that never appears in dependency files at all.
A developer copies a function from another project. Or drops a modified library straight into the repository. No package manager records it. Manifest analysis passes over it without a word. The resulting SBOM quietly understates what the product contains.
SCANOSS matches source code fragments against a database of known open-source projects. Matches feed into provenance research, license identification, and SBOM completion. A match on its own proves nothing about license violations. The tool does not claim otherwise.
Source-level analysis fills the gap that package checks leave open:
- Snippet matching for copied and modified fragments;
- Source provenance work to establish likely origin;
- License intelligence that maps found components to licensing data.
SCANOSS helps organizations dealing with legacy code, internal forks, and AI-assisted development output. That last category keeps growing, and it is the one most teams underestimate. Code generated with a model often borrows patterns from somewhere. Nobody logs a license header. Snippet matching becomes the only realistic way to notice before a customer or an auditor does.
3. TrustSource: From License Flags to Release Evidence
TrustSource handles component inventory and documentation for open-source usage.
A detected license rarely gives enough information for a decision. How a component gets used or distributed changes the obligations it creates. TrustSource organizes license data and checks for conflicts between conditions that cannot coexist.
Audit documentation is the other half. The platform generates NOTICE files with authors, copyright, and license details, and builds SBOMs for individual releases. Automated checks ease the compliance process. They do not replace legal review.
Practical tools for documenting license review results include:
- License compatibility checks for potentially incompatible terms;
- NOTICE generation for attribution documents;
- Release SBOMs tied to specific product versions.
TrustSource fits teams with recurring audits, external customers, and a formal license review process. Legal departments tend to like it for a different reason. The output looks the same every release, so reviewing it does not turn into a fresh investigation each quarter.
4. ScanCode.io: File-Level Answers for Difficult Audits
ScanCode.io from nexB delivers automated SCA with detailed file and package results.
Some projects need more than the package license. A single repository can hold files under different license terms with separate copyright notices. ScanCode.io lets you examine that level of detail rather than trusting a summary.
License policies get configured through settings, with compliance alerts when something crosses a line. Results export to SPDX, CycloneDX, and other formats. Reproducibility and data availability for later analysis sit at the center of the design.
Mechanisms that matter for detailed source review:
- File-level analysis of licenses and copyright in individual files;
- Policy configuration for allowed and problematic licenses;
- Structured exports to SPDX, CycloneDX, and attribution reports.
ScanCode.io works for teams that want evidentiary detail, not a final risk score. Acquisitions are a common trigger. A buyer shows up, asks what is in the codebase, and a summary answer falls apart under questioning. File-level records hold up.
5. Xygeni: Supply Chain Checks Before a Package Ships
Xygeni brings SCA, license analysis, and dependency control under software supply chain security.
Picking third-party packages happens fast during development. A library with no known CVE can still cause trouble. Suspicious scripts. Malicious content. Dubious origins. Xygeni checks those signals alongside conventional dependency vulnerabilities.
License control and reporting follow a similar path. The platform verifies open-source licenses. It builds dependency inventories. SBOMs export in SPDX and CycloneDX. Application composition becomes visible before shipping changes, which is the point.
Package analysis connects to specific supply chain controls:
- Package threat detection that flags potentially malicious packages;
- License risk checks covering third-party component licensing;
- SBOM and VDR export for inventory and vulnerability data.
Xygeni fits DevSecOps teams that treat licensing as one part of supply chain risk. Not a separate discipline. Typosquatting and dependency confusion attacks make this practical. A package name looks right. The code inside is not. License review never catches it, because nobody scans for malice during a legal check.
Closing Notes
Effective SCA begins with solid inventory and goes well past a component list. Aikido manages technical and licensing risk together. The rest handle narrower jobs: code fragments outside manifests, license obligations, file-level evidence, package threats. Data completeness matters. So do reproducible checks and the right SBOM format. Automated reports support decisions. The final call on legal obligations still needs a professional eye.
