> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scanoss.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Decoration Commands

> Query vulnerabilities, cryptography, licenses, geoprovenance, copyright, and component data directly from the SCANOSS API.

The decoration commands query the SCANOSS API about **known components**, no source tree, no scan, no fingerprinting. Reach for one when you already know the package (or package version) you care about and just want data on it: is this version of `pkg:github/scanoss/engine` affected by a known CVE, what license does it declare, which countries did its contributors work from.

<Note>
  This is different from [`enrich`](enrich-and-dependencies#enrich), which
  takes those same layers and applies them across every component in an
  existing inventory or SBOM. Reach for `enrich` when you have a file full
  of components; reach for a decoration command when you have one PURL and
  a question.
</Note>

## Shared Mechanics

Each command below is a parent with one subcommand per operation; running it bare uses the **default** operation.

Input is a list of PURLs:

```bash theme={null}
# One PURL
scanoss-cli vulnerabilities --purl 'pkg:github/scanoss/engine'

# Several, repeat the flag
scanoss-cli vulnerabilities --purl 'pkg:github/scanoss/engine' --purl 'pkg:github/scanoss/scanoss.py'

# Or from a file
scanoss-cli vulnerabilities --input purls.txt
```

The `--input` file is either newline-delimited `purl[,requirement]`, or JSON `{"components":[{"purl":"...","requirement":"..."}]}`. Either way, the list is split into chunks and queried concurrently, tune this with `--chunk-size` (PURLs per request, default `10`) and `-t, --workers` (max concurrent requests, default `5`).

## Vulnerabilities

Known CVEs and CPEs for a component.

```bash theme={null}
scanoss-cli vulnerabilities --purl 'pkg:github/scanoss/engine' --api-key "$SCANOSS_API_KEY"           # components (default)
scanoss-cli vulnerabilities cpes --purl 'pkg:github/scanoss/engine' --api-key "$SCANOSS_API_KEY"
```

**Subcommands:** `components` (default), `cpes`.

## Cryptography

Algorithms in use, library hints, and the version ranges they apply to. The version or range goes in `--requirement`.

```bash theme={null}
scanoss-cli cryptography --purl 'pkg:github/scanoss/engine' --requirement '5.0.1' --api-key "$SCANOSS_API_KEY"
scanoss-cli cryptography algorithms-range --purl 'pkg:github/scanoss/engine' --requirement '>5.0.0' --api-key "$SCANOSS_API_KEY"
scanoss-cli cryptography hints-range --purl 'pkg:github/scanoss/engine' --requirement '>5.0.0' --api-key "$SCANOSS_API_KEY"
```

**Subcommands:** `algorithms` (default), `algorithms-range`, `versions-range`, `hints`, `hints-range`.

## Licenses

Declared licenses, attribution text, and per-file evidence.

```bash theme={null}
scanoss-cli licenses --purl 'pkg:github/scanoss/engine' --api-key "$SCANOSS_API_KEY"              # declared (default)
scanoss-cli licenses attribution --purl 'pkg:github/scanoss/engine' --api-key "$SCANOSS_API_KEY"
scanoss-cli licenses evidence --purl 'pkg:github/scanoss/engine' --api-key "$SCANOSS_API_KEY"
```

**Subcommands:** `declared` (default), `attribution`, `evidence`.

## Geoprovenance

Where a component's contributors are located.

```bash theme={null}
scanoss-cli geoprovenance --purl 'pkg:github/scanoss/engine' --requirement '5.4.7' --api-key "$SCANOSS_API_KEY"   # origin (default)
scanoss-cli geoprovenance countries --purl 'pkg:github/scanoss/engine' --api-key "$SCANOSS_API_KEY"
```

**Subcommands:** `origin` (default), `countries`.

## Copyright

Copyright evidence found in a component's source, and who holds it.

```bash theme={null}
scanoss-cli copyright --purl 'pkg:github/scanoss/engine' --api-key "$SCANOSS_API_KEY"              # evidence (default)
scanoss-cli copyright holders --purl 'pkg:github/scanoss/engine' --api-key "$SCANOSS_API_KEY"
```

**Subcommands:** `evidence` (default), `holders`.

## Components

Search for components, and look up their known versions, release notes, and lifecycle status. Unlike the commands above, `search`, `versions`, and `releases` take their own flags instead of a PURL list.

```bash theme={null}
# Search by vendor/component/term
scanoss-cli components --vendor scanoss --component engine --limit 20 --api-key "$SCANOSS_API_KEY"
scanoss-cli components search --search engine --purl-type github --limit 20 --offset 0 --api-key "$SCANOSS_API_KEY"

# Known versions (with licenses) for a purl
scanoss-cli components versions --purl 'pkg:github/scanoss/engine' --limit 50 --api-key "$SCANOSS_API_KEY"

# Release notes for a purl: all, a single version, or a semver range
scanoss-cli components releases --purl 'pkg:github/scanoss/engine' --api-key "$SCANOSS_API_KEY"
scanoss-cli components releases --purl 'pkg:github/scanoss/engine' --requirement '5.4.7' --api-key "$SCANOSS_API_KEY"
scanoss-cli components releases --purl 'pkg:github/scanoss/engine' --requirement '>=1.0.0, <=2.0.0' --limit 10 --offset 0 --api-key "$SCANOSS_API_KEY"

# Lifecycle status for a PURL list
scanoss-cli components status --purl 'pkg:github/scanoss/engine' --requirement '1.2.3' --api-key "$SCANOSS_API_KEY"
```

**Subcommands:** `search` (default) — `--search`, `--vendor`, `--component` (at least one required), `--purl-type` (default `github`), `--limit`, `--offset`. `versions` — `--purl`, `--limit`. `releases` — `--purl` (required), `--requirement` (an exact version or a semver range; omit it to list every release). `status` — takes the standard PURL list.

<Note>
  When a component exists but has no release notes for the resolved
  version, the API returns `RELEASE_NOTES_UNAVAILABLE`: the command prints
  a "no release notes available" notice on stderr, still emits the JSON,
  and exits `0` — this is not treated as an error.
</Note>

For the complete flag list on every decoration command and subcommand, see [Commands & Arguments](commands-and-arguments).