Skip to main content

​
General Arguments

The following arguments are available on all commands:
ArgumentDescription
--version, -VOutput version number
--help, -hDisplay help for command

​
scan

Scans a folder or file against the SCANOSS API to identify open-source components, licences, vulnerabilities, and dependencies. Results are written to STDOUT by default. 
scanoss-js scan [OPTIONS] <source>
ArgumentDescription
--wfp, -wScan a pre-generated .wfp fingerprint file instead of a folder
--hpsm, -HEnable High Precision Snippet Matching
--extract, -xExtract compressed files before scanning into a <zip_name>-unzipped folder
--extract-overwriteOverwrite the decompressed folder if it already exists
--extract-deep <number>Set the recursion depth for decompression
--extract-suffix <suffix>Set a custom suffix for the decompressed folder name
--concurrency <number>, -cNumber of concurrent connections to use while scanning (default: 10)
--ignore <file>, -nIgnore components listed in an SBOM file
--output <filename>, -oWrite results to a file (default: STDOUT)
--format <format>, -fOutput format: json, html (default: json)
--flags <flags>, -FScanning engine flags: 1 disable snippets, 2 enable snippet IDs, 4 disable dependencies, 8 disable licences, 16 disable copyrights, 32 disable vulnerabilities, 64 disable quality, 128 disable cryptography, 256 disable best match, 512 report identified files
--min-snippet-hits <number>Minimum snippet hits required for a match (0 defers to server configuration)
--min-snippet-lines <number>Minimum snippet lines required for a match (0 defers to server configuration)
--ranking <value>Enable or disable result ranking: true or false (default: server configuration)
--ranking-threshold <number>Ranking threshold value from -1 to 10 (-1 defers to server configuration)
--honour-file-exts <value>Honour file extensions during scanning: true or false (default: server configuration)
--post-size <postsize>, -PMaximum kilobytes per API request (default: 32)
--max-retry <retry>, -RMaximum number of retries for each POST request (default: 5)
--timeout <timeout>, -MAPI communication timeout in seconds (default: 120)
--obfuscateObfuscate file paths in fingerprints before sending
--dependencies, -DInclude dependency scanning alongside file scanning
--cryptography, -CInclude cryptography detection alongside file scanning
--algorithm-rules <path>, -arPath to a custom cryptographic algorithm rules file (JSON)
--library-rules <path>, -lrPath to a custom cryptographic library rules file (JSON)
--apiurl <url>SCANOSS API URL (default: https://api.osskb.org/scan/direct)
--api2url <url>SCANOSS gRPC API 2.0 URL (default: api.scanoss.com:443)
--key <key>, -kSCANOSS API key token (not required for the default OSSKB URL)
--ignore-cert-errorsIgnore SSL certificate errors (use only in trusted environments)
--ca-cert <cert>Path to a custom CA certificate PEM file for SSL/TLS connections
--proxy <url>Proxy URL. Also reads from the HTTPS_PROXY and grpc_proxy environment variables
--grpc_proxy <url>gRPC proxy URL
--verbose, -vEnable verbose output during scanning
--settings <filename>, -stSettings file to use for scanning (default: scanoss.json)
--skip-settings-file, -stfSkip the default scanoss.json settings file
--debugEnable debug output
When --cryptography is used without an API key (--key), only local cryptography detection is performed. Component-level cryptography scanning via the SCANOSS API requires an API key.
The --dependencies flag is not applicable when scanning a pre-generated .wfp fingerprint file, as dependency manifest files are not captured in fingerprint hashes.

​
dep

Scans a folder exclusively for dependency manifest files without performing open-source code identification. 
scanoss-js dep [OPTIONS] <source>
ArgumentDescription
--output <filename>, -oWrite results to a file (default: STDOUT)
--apiurl <url>SCANOSS API URL (default: https://api.osskb.org/scan/direct)
--key <key>, -kSCANOSS API key token (not required for the default OSSKB URL)
--ignore-cert-errorsIgnore SSL certificate errors (use only in trusted environments)
--ca-cert <cert>Path to a custom CA certificate PEM file for SSL/TLS connections
--proxy <url>Proxy URL. Also reads from the HTTPS_PROXY environment variable
--debugEnable debug output
The following dependency manifest files are recognised during scanning:
EcosystemFiles
Pythonrequirements.txt, pip_requirements_lock.txt, *-requirements.txt, requirements-*.txt, dev-requirements.txt, pyproject.toml
Javapom.xml
JavaScriptpackage.json, package-lock.json (v1, v2, v3), yarn.lock, pnpm-lock.yaml (v5, v6, v9+)
RubyGemfile, Gemfile.lock
Golanggo.mod, go.sum
.NET / NuGet*.csproj, packages.config
Gradlebuild.gradle, build.gradle.kts, libs.versions.toml

​
wfp

Generates WFP (Winnowing FingerPrint) hashes for a folder or file without performing any API calls or analysis. The resulting output can be saved to a file and passed to scan at a later time using the --wfp flag. 
scanoss-js wfp [OPTIONS] <source>
ArgumentDescription
--hpsm, -HEnable High Precision Snippet Matching
--obfuscateObfuscate file paths in fingerprints
--output <filename>, -oWrite fingerprints to a file (default: STDOUT)
--block-size <size>, -pMaximum size in KB for each fingerprint block (default: 64)

​
crypto

Scans a folder or file for local cryptographic algorithm and library detection without performing open-source identification. Custom detection rules can be provided via JSON files. 
scanoss-js crypto [OPTIONS] <source>
ArgumentDescription
--algorithm-rules <path>, -arPath to a custom cryptographic algorithm rules file (JSON)
--library-rules <path>, -lrPath to a custom cryptographic library rules file (JSON)
--output <filename>, -oWrite results to a file (default: STDOUT)
--threads <threads>, -TNumber of threads to use while scanning (default: 5)

​
components

Queries the SCANOSS Knowledge Base for component intelligence. Supports searching, version lookups, statistics, and component information retrieval. 
scanoss-js components <action> [OPTIONS]
The <action> argument must be one of: search, versions, stats, info.
ArgumentDescription
--output <filename>, -oWrite results to a file (default: STDOUT)
--apiurl <url>SCANOSS API URL (default: https://api.osskb.org)
--key <key>, -kSCANOSS API key token
--ignore-cert-errorsIgnore SSL certificate errors (use only in trusted environments)
--ca-cert <cert>Path to a custom CA certificate PEM file for SSL/TLS connections
--proxy <url>Proxy URL
--grpcUse gRPC instead of HTTP for API calls
--debugEnable debug output
ArgumentDescription
--query <query>, -qSearch query string
--vendor <vendor>Filter by vendor name
--component <component>Filter by component name
--package <package>Filter by package type (e.g. npm, maven)
--limit <limit>Maximum number of results to return
--offset <offset>Result offset for pagination

​
versions

ArgumentDescription
--purl <purl>Package URL (PURL) to look up

​
stats

ArgumentDescription
--purls <purls>Comma-separated list of PURLs for statistics
--purls-file <file>File containing PURLs, one per line

​
info

ArgumentDescription
--name <name>Component name to look up
--include-versionsInclude version information in the response
--include-statsInclude statistics in the response