Input & Mode Parameters
| Parameter | Short | Description |
|---|---|---|
--wfp | -w | Process TARGET as a .wfp fingerprint file, regardless of its actual extension |
--hpsm | -H | Enable High Precision Snippet Matching mode (requires libhpsm.so installed on the system) |
--sbom FILE | -s | Use assets declared in the provided CycloneDX/SPDX 2.2 JSON SBOM to guide component identification |
--blacklist FILE | -b | Exclude assets listed in the provided CycloneDX/SPDX 2.2 JSON SBOM from scan results |
--force-snippet | Same as --blacklist, but forces snippet matching regardless of file extension or asset exclusion rules | |
--component HINT | -c | Provide a component name hint to guide scan results |
Matching & Tuning Parameters
| Parameter | Short | Description |
|---|---|---|
--max-snippets NUM | -M | Search for up to NUM distinct components per file (maximum: 9) |
--max-components NUM | -N | Set the maximum number of components returned per match (default: 5) |
--tolerance NUM | -T | Set snippet matching tolerance percentage (default: 0.1) |
--rank NUM | -r | Set the maximum component rank accepted (default: 11). Lower rank values indicate a closer match to the scanned file |
--max-files NUM | Set the maximum number of files to fetch during matching (default: 12000) | |
--min-match-hits NUM | Set the minimum number of snippet ID hits required for a match (default: 3). Overrides automatic threshold adjustment | |
--min-match-lines NUM | Set the minimum number of matched lines required per range (default: 10). Overrides automatic threshold adjustment | |
--range-tolerance NUM | Set the maximum number of non-matched lines tolerated within a range (default: 5) | |
--ignore-file-ext | Ignore file extension during snippet matching (default: honour extension) |
Output & Utility Parameters
| Parameter | Short | Description |
|---|---|---|
--attribution FILE | -a | Show attribution notices for the components declared in the provided sbom.json file |
--key KEY | -k | Show the contents of the specified KEY file from the MZ sources archive |
--license LICENSE | -l | Display Open Source Automation Development Lab (OSADL) metadata for the given SPDX licence ID |
--full-license | -L | Enable full licence report |
--flags FLAGS | -F | Set engine scanning flags (see Flag-Based Configuration below) |
--name NAME | -n | Set the database name (default: oss) |
--debug | -d | Write debugging information to disk (/tmp) |
--quiet | -q | Suppress JSON output (debugging information is still written to STDERR) |
--test | -t | Run engine performance tests |
--version | -v | Display the installed version of the SCANOSS Engine |
--help | -h | Display help information and exit |
Flag-Based Configuration
The-F / --flags parameter accepts a numeric bitmask that controls which data
categories are included in or excluded from scan output. Flags can also be set
persistently in /etc/scanoss_flags.cfg so that they apply to every scan without
needing to be passed on the command line.
Flag values are combined by summing their numeric values. For example, to disable
both dependencies (4) and licences (8), pass -F 12.
| Flag | Setting |
|---|---|
| 1 | Disable snippet matching (default: enabled) |
| 2 | Enable snippet IDs in output (default: disabled) |
| 4 | Disable dependency data (default: enabled) |
| 8 | Disable licence data (default: enabled) |
| 16 | Disable copyright data (default: enabled) |
| 32 | Disable vulnerability data (default: enabled) |
| 64 | Disable quality data (default: enabled) |
| 128 | Disable cryptography data (default: enabled) |
| 256 | Disable best-match-only filtering (default: enabled) |
| 512 | Hide identified files from output (default: disabled) |
| 1024 | Enable download URL in output (default: disabled) |
| 2048 | Enable path hint logic (default: disabled) |
| 4096 | Disable extended server statistics (default: enabled) |
| 8192 | Disable health layer data (default: enabled) |
| 16384 | Enable increased matching precision (reduced scan speed; default: disabled) |
Environment Variables
| Variable | Description |
|---|---|
SCANOSS_MATCHMAP_MAX | Set the snippet matching map size (default: 10000) |
SCANOSS_FILE_CONTENTS_URL | Define the API URL endpoint for retrieving source file contents. If this variable is not defined, source file URLs will be omitted from scan output. |
Configuration File
Flags can be persisted to avoid passing them on every invocation. Write flag values to:12 to disable both dependencies and licences).