install

Additional install commands

macOS

Homebrew Caskverified · 100%

brew install --cask fossa

local Homebrew cask metadata

overview

Package summary

Zero-configuration polyglot dependency analysis tool

Project links

Homepage

Commands and aliases

fossa

history

Project history and usage

FOSSA CLI is the command-line client for FOSSA's dependency analysis, license compliance, security scanning, attribution, and SBOM-oriented workflows. It is packaged as the `fossa` executable and distributed for local developer use and CI automation.

Project history

The public `fossas/fossa-cli` repository was created in 2018. The README describes the tool as zero-configuration, polyglot dependency analysis that detects dependencies in a codebase or build and uploads analysis results to the FOSSA web application.

The repository documentation grew into a user manual covering integration walkthroughs, analysis targets, vendored dependencies, manual dependencies, container scanning, SBOM analysis, debugging, and command references.

Adoption history

The README documents installation by shell script, PowerShell, GitHub Releases, Scoop, and a Homebrew cask, with the cask updated automatically. It also displays a downloads badge in the millions, indicating broad binary distribution through GitHub Releases.

How it is used

A typical workflow is to install `fossa`, set `FOSSA_API_KEY`, run `fossa analyze` in a project directory, review results in the FOSSA web application, and optionally gate CI with `fossa test` or integrate with GitHub status checks.

Why package nerds care

FOSSA CLI is representative of compliance tooling becoming a package-manager-aware developer tool. Its value comes from recognizing many language ecosystems and build tools, combining static and dynamic dependency strategies, and turning local package metadata into organization-level license and vulnerability reports.

Timeline

2018: The public `fossas/fossa-cli` repository was created.
2023: FOSSA's hosted docs version metadata records the current docs line as created in July 2023.
2026: v3.17.11 was published on GitHub Releases.

Related projects

FOSSA CLI is related to the FOSSA web application, FOSSA API keys, GitHub status integrations, SBOM workflows, container scanners, and the package managers and build systems it analyzes across JavaScript, Python, Go, Java, .NET, Rust, Haskell, Fortran, and other ecosystems.

Sources

security posture

No protected-tool coverage found yet

No matching local secret-handling manifest was found for fossa. Nucleus package metadata is still published here so future coverage has a stable package URL.

Install behavior

No Homebrew bottle metadata was recorded.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix: .fossa.yml

executables

Installed executables

Command	Kind	Exposure	Note
`fossa`	binary	Homebrew cask binary	fossa

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-08-03

manager version3.17.15

manager updated2026-07-27

local dataunknown

upstreamnot available

latest detectednot detected

okNo freshness warnings were generated.

install metadata

Package metadata

Package key	cask:fossa
Version	3.17.15
Package manager	Homebrew Cask
Homepage	https://fossa.com/
Last updated	2026-07-27T19:19:48Z
Pulse	updated
SHA-256	2042f6b5f7b93e28948c4ebcbb76b240379fdab467640d4842d3de50ea0f47c3
Download URL	https://github.com/fossas/fossa-cli/releases/download/v3.17.15/fossa_3.17.15_darwin_arm64.zip
Bottle	not recorded
Service	none declared

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Scoop95%

main/fossa

scoop install main/fossa

normalized package name match
Matched by: Fossa

Scoop official bucket manifest trees · api.github.com · Scoop official bucket manifest trees: bucket/fossa.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1

winget95%

FOSSA.FOSSA-cli

winget install --id FOSSA.FOSSA-cli -e

normalized package name match
Matched by: Fossa

Windows Package Manager source index · cdn.winget.microsoft.com · Windows Package Manager source index: FOSSA.FOSSA-cli from https://cdn.winget.microsoft.com/cache/source.msix

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Combined YAML source

View the package source record on GitHub.

combined/fossa.yml

Used sources

cross-ecosystem install command graph
curated configuration and credential file locations
curated package history
external package-manager database matches
pkg.so package database
pkgdb category and tag curation

Install fossa with Homebrew Cask