Quick Start

The examples below assume you’ve already stored an API key, as covered in Configuration: scanoss-cli config set api-key SC_abc123def456. Without a stored key, add --api-key "$SCANOSS_API_KEY" to each command instead.

First Scan

# Scan a project and save JSON results
scanoss-cli scan ./my-project --output results.json

# Generate fingerprints only, no upload
scanoss-cli wfp ./my-project > project.wfp

# Refresh vulnerabilities/licenses on an existing inventory, no re-scan
scanoss-cli enrich results.json --include vulns,licenses > enriched.json

Add -v / --verbose to any command for structured debug logging on stderr, the scan flow, each API request (method/URL/status/duration), and fingerprinting. Stdout stays reserved for results, so logs never corrupt --output or piped JSON.

Common Use Cases

Generate an SBOM directly from a scan:

scanoss-cli scan ./my-project --format cyclonedx --output sbom-cdx.json
scanoss-cli scan ./my-project --format spdx      --output sbom-spdx.json

Include extra output layers (dependencies, vulnerabilities, licenses, cryptography, geoprovenance):

scanoss-cli scan ./my-project --include deps,vulns,licenses

Look up a single component without scanning anything, identified by its PURL (Package URL, the pkg:type/namespace/name@version scheme used throughout SCANOSS-CLI):

scanoss-cli vulnerabilities --purl 'pkg:github/scanoss/engine'
scanoss-cli licenses --purl 'pkg:github/scanoss/engine'

Resume an interrupted scan:

scanoss-cli results <scan-id> --output results.json

Next Steps

This page covers the fastest path to a first result. For the full flag reference on every command, see Commands & Arguments.

Documentation

Links

First Scan

Common Use Cases

Next Steps

​First Scan

​Common Use Cases

​Next Steps

First Scan

Common Use Cases

Next Steps