> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scanoss.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> [SCANOSS-CLI](https://github.com/scanoss/scanoss.go) is the Go implementation of the SCANOSS command-line tool and SDK, for scanning source code and querying the SCANOSS platform.

SCANOSS-CLI fingerprints your project using Winnowing (WFP), uploads the fingerprints to the SCANOSS v3 API, and returns matched components. Results can be decorated with vulnerability, license, cryptography, geoprovenance, copyright, dependency, and component data in the same request.

## How It Works

1. **Fingerprint**: `scan` reads your source files and generates Winnowing fingerprints (WFP), a compact representation of the code, not the code itself.
2. **Upload**: The fingerprints are sent to the SCANOSS v3 API and matched against the SCANOSS Knowledge Base.
3. **Match**: The API returns the open source components and files your code matches.
4. **Decorate** *(optional)*: Add vulnerability, license, cryptography, geoprovenance, copyright, dependency, or component data to those matches, either in the same `scan`, or afterwards with `enrich`.

```mermaid theme={null}
graph LR
    Src[Your Source Code] --> FP[Fingerprint<br/>Winnowing / WFP]
    FP --> API[SCANOSS v3 API]
    API --> Match[Matched Components]
    Match -.->|optional| Dec[Decorate<br/>vulns / licenses / crypto / geo]

    style Src fill:#42A5F5,stroke:#1E88E5,stroke-width:2px,color:#fff
    style FP fill:#26A69A,stroke:#00897B,stroke-width:2px,color:#fff
    style API fill:#26A69A,stroke:#00897B,stroke-width:2px,color:#fff
    style Match fill:#8E24AA,stroke:#6A1B9A,stroke-width:2px,color:#fff
    style Dec fill:#BA68C8,stroke:#6A1B9A,stroke-width:2px,color:#fff
```

## Commands

Once you're ready to try it, here's every command this tool provides:

| Command               | Purpose                                                                                                                                                                                  | Documented in                                                                                            |
| --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
| `scan <path>`         | Fingerprint a folder/file, scan against the SCANOSS v3 API, and output results (`--format raw`/`spdx`/`cyclonedx`; opt into dependency/vuln/license/crypto/geo layers with `--include`). | [Commands & Arguments § scan](commands-and-arguments#scan)                                               |
| `scan wfp <wfp>`      | Scan a pre-generated WFP file (no fingerprinting).                                                                                                                                       | [Commands & Arguments § scan](commands-and-arguments#scan)                                               |
| `wfp <path>`          | Generate WFP fingerprints only (no upload).                                                                                                                                              | [Commands & Arguments § wfp](commands-and-arguments#wfp)                                                 |
| `results <scan-id>`   | Resume or poll a scan by its id.                                                                                                                                                         | [Commands & Arguments § results](commands-and-arguments#results)                                         |
| `sbom <input>`        | Produce an SBOM from a raw inventory, or convert between formats, offline (CycloneDX/SPDX).                                                                                              | [Output Formats & SBOM § Converting Between Formats](output-formats-and-sbom#converting-between-formats) |
| `enrich <input>`      | Add purl-keyed layers (vulns/licenses/crypto/geo) to a `raw` or SBOM file.                                                                                                               | [Enrich & Dependencies § Enrich](enrich-and-dependencies#enrich)                                         |
| `dependencies [path]` | Extract local dependencies, or query direct/transitive dependencies for a PURL.                                                                                                          | [Enrich & Dependencies § Dependencies](enrich-and-dependencies#dependencies)                             |
| `vulnerabilities`     | Known vulnerabilities / CPEs for components.                                                                                                                                             | [Decoration Commands § Vulnerabilities](decoration-commands#vulnerabilities)                             |
| `cryptography`        | Algorithms, library hints, and version ranges.                                                                                                                                           | [Decoration Commands § Cryptography](decoration-commands#cryptography)                                   |
| `licenses`            | Declared licenses, attribution files, per-file evidence.                                                                                                                                 | [Decoration Commands § Licenses](decoration-commands#licenses)                                           |
| `geoprovenance`       | Component origin and contributor countries.                                                                                                                                              | [Decoration Commands § Geoprovenance](decoration-commands#geoprovenance)                                 |
| `copyright`           | Copyright evidence and holders.                                                                                                                                                          | [Decoration Commands § Copyright](decoration-commands#copyright)                                         |
| `components`          | Search, versions, and lifecycle status.                                                                                                                                                  | [Decoration Commands § Components](decoration-commands#components)                                       |
| `config`              | Store settings in `~/.scanoss/settings.json`.                                                                                                                                            | [Configuration § Storing Credentials](configuration#storing-credentials)                                 |

<Note>
  For the full flag reference on every command and subcommand, see [Commands &
  Arguments](commands-and-arguments).
</Note>

## Debug Logging

Add `-v` / `--verbose` to any command for structured debug logging on stderr, the scan flow, each API request (method/URL/status/duration), and fingerprinting. Stdout stays reserved for results, so logs never corrupt `--output` or piped JSON.

## The Go SDK

Beyond the CLI, `pkg/scanoss` is a Go SDK for the same services: a decoration pipeline that runs a configurable set of services over the same PURLs in parallel, per-service progress reporting, structured logging, and scanning directly from Go code. See the [Go SDK](/en/latest/sdks/go/overview) section.