Skip to main content
SCANOSS-CLI fingerprints your project using Winnowing (WFP), uploads the fingerprints to the SCANOSS v3 API, and returns matched components. Results can be decorated with vulnerability, license, cryptography, geoprovenance, copyright, dependency, and component data in the same request.

​
How It Works

  1. Fingerprint: scan reads your source files and generates Winnowing fingerprints (WFP), a compact representation of the code, not the code itself.
  2. Upload: The fingerprints are sent to the SCANOSS v3 API and matched against the SCANOSS Knowledge Base.
  3. Match: The API returns the open source components and files your code matches.
  4. Decorate (optional): Add vulnerability, license, cryptography, geoprovenance, copyright, dependency, or component data to those matches, either in the same scan, or afterwards with enrich.

​
Commands

Once you’re ready to try it, here’s every command this tool provides:
For the full flag reference on every command and subcommand, see Commands & Arguments.

​
Debug Logging

Add -v / --verbose to any command for structured debug logging on stderr, the scan flow, each API request (method/URL/status/duration), and fingerprinting. Stdout stays reserved for results, so logs never corrupt --output or piped JSON.

​
The Go SDK

Beyond the CLI, pkg/scanoss is a Go SDK for the same services: a decoration pipeline that runs a configurable set of services over the same PURLs in parallel, per-service progress reporting, structured logging, and scanning directly from Go code. See the Go SDK section.