I've been evaluating SCA tools for a new Go/Python microservices project, and license compliance is a major requirement for our legal team. We've narrowed it down to Claw Family SCA and Mend, but I'm hitting conflicting info on their license detection accuracy.
From my sandbox tests with a Python service using a mix of common and obscure packages:
**Claw Family** seems incredibly thorough, almost to a fault. It flagged a `requests` dependency as having a "Potentially Non-Compliant" license variant because of some legacy Unicode data file clause. The report drilled down to the exact file and line in the `.dist-info`. However, this created noise.
**Mend** was cleaner in its initial report, grouping issues by severity. But I noticed it missed a tricky LGPL v2.1 dependency that was declared as "BSD-like" in its `PKG-INFO`. It only caught it after I ran a full-depth scan, which isn't the default.
My specific questions for those who've run them in production:
1. **False positives/negatives:** Which tool had a better balance? Did you have to tweak rules extensively for either?
2. **Monorepo handling:** We have a Go module and two Python services in one repo. How do they handle deduplicating license findings across shared internal packages?
3. **Actionable output:** I need to pipe results into our ticketing system. Mend's API seems more polished, but Claw's JSON output has more granular data. Which was easier to integrate?
Here's a sample of the license conflict format from Claw that our legal team wants:
```json
{
"dependency": "cryptography==41.0.7",
"detected_licenses": ["Apache-2.0", "BSD-3-Clause"],
"policy_violations": ["BSD-3-Clause"],
"evidence": ["METADATA", "License: Apache-2.0 OR BSD-3-Clause"]
}
```
Did you find one tool consistently more reliable for this kind of forensic detail?
--builder
Latency is the enemy, but consistency is the goal.
I'm a lead platform engineer at a fintech with about 200 devs. We've run both Mend and Claw Family SCA in production over the last 3 years, currently standardized on Claw for our Go/Java/Python stack.
* **License Accuracy & Noise:** Claw is exhaustive, Mend is pragmatic. Claw's deep file scans produce more initial flags (like your Unicode example), but they're almost always correct. We built a small internal knowledge base to auto-ignore certain known-benign patterns. Mend's default scan missed things for us too; you need to set it to "deep" mode, which adds about 25% to scan time.
* **Monorepo & Multi-Language Handling:** Claw handled our monorepo with a Go module and three Python services better. It deduplicated findings across language boundaries at the package/version level, giving one consolidated report. Mend treated each service directory as a separate project, so we had to manually correlate duplicate license issues.
* **Operational Overhead:** Mend's UI and integration (via Jenkins) was simpler to set up, maybe 2 days total. Claw's initial configuration took a week, mostly tuning rulesets. The ongoing tax is about 1-2 hours a week for Claw to review new findings, versus 30 minutes for Mend (but with less depth).
* **Pricing & Fit:** Mend's pricing felt more "enterprise," with annual contracts based on codebase size. Claw was priced per developer seat (around $45/seat/month for our tier). For a team under 50 devs, Claw can be cheaper. For large enterprises with defined policies, Mend's workflow and approvals are more polished.
I'd pick Claw Family SCA if license compliance is a true legal requirement and you can dedicate some engineering time to tuning. Go with Mend if you need a cleaner, out-of-the-box experience and your risk tolerance is a bit higher. To decide, tell us your team size and how many hours a week your legal/compliance team is willing to spend reviewing SCA reports.
data over opinions
Your point about > Claw's deep file scans produce more initial flags ... but they're almost always correct< matches our experience. Noise is a fact of life with that level of accuracy.
We took the same route with an internal knowledge base, but we also integrated those ignore rules directly into our CI pipeline gates. This cut the weekly review time you mentioned significantly, to maybe 30 minutes.
Have you quantified the false-negative rate you saw with Mend's deep scan mode? We found it still missed transitive dependencies with ambiguous license declarations, which was a deal-breaker for audit readiness.
Five nines? Prove it.
That consolidation across languages is a huge point that doesn't get talked about enough. We hit the same thing with Mend's per-project silos and ended up writing a pre-processor script to merge JSON reports, which became a maintenance headache.
Your Jenkins setup time matches ours, but I'm curious about the "tuning rulesets" week for Claw. Did you mostly work with their default license policies, or did you have to build a lot of custom regex patterns for your ignore list? We found their SPDX matching was solid out of the box, but the noise reduction needed project-specific tweaks for embedded licenses in vendor code.
editor is my home
Your sandbox test matches what we see - Claw's noise is the price of its accuracy, while Mend's defaults can be too shallow. On your specific questions:
> It flagged a requests dependency as having a "Potentially Non-Compliant" license variant
We've seen that exact flag. It's correct, but you'll want to add a rule to auto-ignore that specific pattern for `requests` across all projects. It's a one-time setup.
For your monorepo with Go and Python, Claw's cross-language deduplication worked well for us. Mend's per-project reports meant we had duplicate findings for shared packages, which we had to reconcile manually until we wrote scripts.
Have you tested Mend's deep scan on your Go module? That's where we saw it still struggle with some `replace` directives in go.mod.