ScanCode Toolkit Integration Guide

Integrate ScanCode Toolkit with Vulnetix. Scan your codebase for licences, copyrights, and package metadata using ScanCode via uv, then upload the CycloneDX or SPDX SBOM to Vulnetix.

Install & scan

$ # Recommended: run without global install
uv run --with scancode-toolkit scancode --version

# Or install globally
pip install scancode-toolkit
$ uv run --with scancode-toolkit scancode   --license --copyright --package   --cyclonedx scan-bom.cdx.json .

Run ScanCode Toolkit in CI

Scan on every push and upload the report as a workflow artifact:

- name: Install uv
  run: curl -LsSf https://astral.sh/uv/install.sh | sh

- name: Run ScanCode
  run: uv run --with scancode-toolkit scancode --license --copyright --package --cyclonedx bom.cdx.json .

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: scancode
    path: bom.cdx.json
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under ScanCode Toolkit's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace ScanCode Toolkit. Keep running it. Vulnetix sits on top of ScanCode Toolkit (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

ScanCode Toolkit is strongest at its core category and also carries features in SCA, SBOM Generation, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What ScanCode Toolkit does well

• Reference-standard license and copyright detection using full-text matching against 1,600+ SPDX license texts
• Renowned for scanning depth and accuracy; underpins ClearlyDefined and is embedded as ORT's scanner
• Parses package manifests across many ecosystems to detect package origin and declared dependencies
• Usable as both a CLI and a Python library for flexible pipeline integration

Where Vulnetix adds to it: ScanCode is the license/copyright detection reference standard; Vulnetix consumes its license findings and adds the vulnerability layer it does not attempt, exploit-intel prioritisation, cross-scanner dedup, versioned VEX, CycloneDX 1.7 / SPDX 2.3 SBOMs and autofix.

No migration, no rip-and-replace. ScanCode Toolkit keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise ScanCode Toolkit results in Vulnetix

Upload ScanCode Toolkit CycloneDX, SPDX, JSON output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

ScanCode Toolkit documentation ↗  ·  Source repository ↗

Wire ScanCode Toolkit into your CI/CD pipeline →