Skip to main content
The decoration commands query the SCANOSS API about known components, no source tree, no scan, no fingerprinting. Reach for one when you already know the package (or package version) you care about and just want data on it: is this version of pkg:github/scanoss/engine affected by a known CVE, what license does it declare, which countries did its contributors work from.
This is different from enrich, which takes those same layers and applies them across every component in an existing inventory or SBOM. Reach for enrich when you have a file full of components; reach for a decoration command when you have one PURL and a question.

​
Shared Mechanics

Each command below is a parent with one subcommand per operation; running it bare uses the default operation. Input is a list of PURLs:
The --input file is either newline-delimited purl[,requirement], or JSON {"components":[{"purl":"...","requirement":"..."}]}. Either way, the list is split into chunks and queried concurrently, tune this with --chunk-size (PURLs per request, default 10) and -t, --workers (max concurrent requests, default 5).

​
Vulnerabilities

Known CVEs and CPEs for a component.
Subcommands: components (default), cpes.

​
Cryptography

Algorithms in use, library hints, and the version ranges they apply to. The version or range goes in --requirement.
Subcommands: algorithms (default), algorithms-range, versions-range, hints, hints-range.

​
Licenses

Declared licenses, attribution text, and per-file evidence.
Subcommands: declared (default), attribution, evidence.

​
Geoprovenance

Where a component’s contributors are located.
Subcommands: origin (default), countries. Copyright evidence found in a component’s source, and who holds it.
Subcommands: evidence (default), holders.

​
Components

Search for components, and look up their known versions, release notes, and lifecycle status. Unlike the commands above, search, versions, and releases take their own flags instead of a PURL list.
Subcommands: search (default) — --search, --vendor, --component (at least one required), --purl-type (default github), --limit, --offset. versions — --purl, --limit. releases — --purl (required), --requirement (an exact version or a semver range; omit it to list every release). status — takes the standard PURL list.
When a component exists but has no release notes for the resolved version, the API returns RELEASE_NOTES_UNAVAILABLE: the command prints a “no release notes available” notice on stderr, still emits the JSON, and exits 0 — this is not treated as an error.
For the complete flag list on every decoration command and subcommand, see Commands & Arguments.