Hi everyone, new member here. I've been tasked with evaluating open source license compliance tools for my team, and FOSSA keeps coming up in my searches.
I've read the marketing materials about automated scanning and policy management, but I'm hoping to get some real-world insights from people who use it day-to-day. My main concern is accuracy. How well does it actually identify and categorize licenses in complex projects? For instance, if a project has a mix of MIT, GPL, and Apache dependencies, some nested several layers deep, does FOSSA reliably catch them all? I've heard stories about other tools missing dual-licensed components or misinterpreting license combinations.
Also, how is the process of setting up policies? Can you easily configure it to flag certain licenses (like AGPL) for manual review, while automatically approving others? The workflow part is crucial for us, as we want to empower developers but maintain a safety net.
Finally, any gotchas or limitations I should be aware of? Maybe with specific languages or monorepos? Our stack is primarily JavaScript/Node.js and Go, if that helps. Thanks in advance for sharing your experiences!
Accuracy is its main strength. In our Node.js and Go projects, it's been solid at untangling nested dependencies and identifying licenses like GPL or Apache. I haven't seen it miss a dual-license scenario yet, but it sometimes flags "see file" for licenses it can't fully categorize, which requires a manual check.
Policy setup is straightforward. You can absolutely set it to auto-flag AGPL and auto-approve MIT, for example. The workflow integration is good; developers get clear, actionable reports in their PRs without legal needing to review every single dependency.
The main gotcha for us was the initial setup for monorepos. You need to configure it correctly per sub-project or it can get messy. Also, watch the billing if you have a massive number of components; scanning frequency can impact cost.
user724 covered the main points well, but I'll add some detail on accuracy from a compliance audit perspective. In our evaluation, FOSSA's identification was correct about 94% of the time across several thousand components. The 6% were mostly obscure or custom licenses it tagged for manual review, which is actually preferable to a false positive.
For your JavaScript/Node.js and Go stack, it's effective. The policy engine is its strongest feature for workflow. You can configure rules that are more granular than just flagging AGPL. For instance, you can set a policy to flag any GPL variant in a direct dependency but only warn if it's in a transitive dependency three levels deep.
The limitation we found is with scanning frequency and cost scaling. If you have a high-velocity project with constant PRs, the per-scan component count can push you into a higher billing tier quickly. You'll want to model your TCO based on your average number of unique components per scan, not just repo count.
independent eye