Command Parameters & Flags

Input & Mode Parameters

Parameter	Short	Description
`--wfp`	`-w`	Process TARGET as a `.wfp` fingerprint file, regardless of its actual extension
`--hpsm`	`-H`	Enable High Precision Snippet Matching mode (requires `libhpsm.so` installed on the system)
`--sbom FILE`	`-s`	Use assets declared in the provided CycloneDX/SPDX 2.2 JSON SBOM to guide component identification
`--blacklist FILE`	`-b`	Exclude assets listed in the provided CycloneDX/SPDX 2.2 JSON SBOM from scan results
`--force-snippet`		Force snippet scanning (disables full file matching)
`--component HINT`	`-c`	Provide a component name hint to guide scan results

Matching & Tuning Parameters

Parameter	Short	Description
`--max-snippets NUM`	`-M`	Search for up to NUM distinct components per file (maximum: 9)
`--max-components NUM`	`-N`	Set the maximum number of components returned per match (default: 5)
`--tolerance NUM`	`-T`	Set snippet matching tolerance percentage (default: 0.1)
`--rank NUM`	`-r`	Set the maximum component rank accepted (default: 11). Lower rank values indicate a closer match to the scanned file
`--max-files NUM`		Set the maximum number of files to fetch during matching (default: 12000)
`--min-snippet-hits NUM`		Set the minimum number of snippet ID hits required for a match (default: 3). Overrides automatic threshold adjustment
`--min-snippet-lines NUM`		Set the minimum number of matched lines required per range (default: 10). Overrides automatic threshold adjustment
`--range-tolerance NUM`		Set the maximum number of non-matched lines tolerated within a range (default: 5)
`--ignore-file-ext`		Ignore file extension during snippet matching (default: honour extension)

Output & Utility Parameters

Parameter	Short	Description
`--attribution FILE`	`-a`	Show attribution notices for the components declared in the provided `sbom.json` file
`--key KEY`	`-k`	Show the contents of the specified KEY file from the MZ sources archive
`--max-file-content-size MB`		Set the maximum file content size in MB printed by `-k` (default: 50)
`--purl MD5`	`-P`	Return the PURLs and versions related to the given file MD5 (JSON output)
`--url-hash MD5`	`-C`	Return the details of the component identified by the given URL hash (JSON output)
`--snippet-scan WFP`	`-S`	Snippet-only scan: accepts a single-file WFP block and returns JSON with candidate file MD5s and their line ranges, filtered by the tolerance set via `-T`. Pass `-` to read the WFP from stdin
`--license LICENSE`	`-l`	Display Open Source Automation Development Lab (OSADL) metadata for the given SPDX licence ID
`--full-license`	`-L`	Enable full licence report
`--flags FLAGS`	`-F`	Set engine scanning flags (see Flag-Based Configuration below)
`--name NAME`	`-n`	Set the database name (default: `oss`)
`--debug`	`-d`	Write debugging information to disk (`/tmp`)
`--quiet`	`-q`	Suppress JSON output (debugging information is still written to STDERR)
`--test`	`-t`	Run engine performance tests
`--version`	`-v`	Display the installed version of the SCANOSS Engine
`--help`	`-h`	Display help information and exit

Flag-Based Configuration

The -F / --flags parameter accepts a numeric bitmask that controls which data categories are included in or excluded from scan output. Flags can also be set persistently in /etc/scanoss_flags.cfg so that they apply to every scan without needing to be passed on the command line. Flag values are combined by summing their numeric values. For example, to disable both dependencies (4) and licences (8), pass -F 12.

Flag	Setting
1	Disable snippet matching (default: enabled)
2	Enable snippet IDs in output (default: disabled)
4	Disable dependency data (default: enabled)
8	Disable licence data (default: enabled)
16	Disable copyright data (default: enabled)
32	Disable vulnerability data (default: enabled)
64	Disable quality data (default: enabled)
128	Disable cryptography data (default: enabled)
256	Disable best-match-only filtering (default: enabled)
512	Hide identified files from output (default: disabled)
1024	Enable download URL in output (default: disabled)
2048	Enable path hint logic (default: disabled)
4096	Disable extended server statistics (default: enabled)
8192	Disable health layer data (default: enabled)
16384	Enable increased matching precision (reduced scan speed; default: disabled)
32768	Enable full licence report (default: disabled)

Environment Variables

Variable	Description
`SCANOSS_MATCHMAP_MAX`	Set the snippet matching map size (default: 10000)
`SCANOSS_FILE_CONTENTS_URL`	Define the API URL endpoint for retrieving source file contents. If this variable is not defined, source file URLs will be omitted from scan output.

Configuration File

Flags can be persisted to avoid passing them on every invocation. Write flag values to:

/etc/scanoss_flags.cfg

The file should contain a single integer representing the combined flag value (e.g., 12 to disable both dependencies and licences).

Examples

# Scan DIRECTORY without licence and dependency data
scanoss -F 12 DIRECTORY
scanoss --flags 12 DIRECTORY

# Scan TARGET including SBOM assets
scanoss --sbom my_sbom.json TARGET

# Scan with custom snippet matching parameters
scanoss --min-snippet-hits 5 --min-snippet-lines 15 TARGET

# Scan with custom range tolerance
scanoss --range-tolerance 10 TARGET

# Ignore file extensions during matching
scanoss --ignore-file-ext TARGET

Documentation

Links

Input & Mode Parameters

Matching & Tuning Parameters

Output & Utility Parameters

Flag-Based Configuration

Environment Variables

Configuration File

Examples

​Input & Mode Parameters

​Matching & Tuning Parameters

​Output & Utility Parameters

​Flag-Based Configuration

​Environment Variables

​Configuration File

​Examples

Input & Mode Parameters

Matching & Tuning Parameters

Output & Utility Parameters

Flag-Based Configuration

Environment Variables

Configuration File

Examples