This page is a run-of-show for demos, not end-user documentation. Each section
pairs the spoken script with a placeholder for the screenshot that goes with
it — replace the placeholder with an actual image once it’s captured.
1. Logging In
To get started with Earnie, you sign in with your organisation’s SSO. Where an administrator has enabled it, email and password sign-in is available too.
2. Onboarding & Setup
As you go through the Earnie onboarding, you’ll get a quick overview of its key capabilities. For this demo, we’ll connect Earnie to a GitHub repository. Earnie connects to GitLab too. Each customer’s Earnie runs in its own isolated environment. Your code stays there: only fingerprints and hashes are sent to SCANOSS.
3. Inviting Your Team
Earnie is designed for collaboration. You can invite people to your workspace and assign roles with specific permissions, giving teams the right level of access across the platform.
4. Choosing Policies
The final step is to choose your policies. Earnie provides a range of pre-built policy templates to help you get started, which you can then customise to fit your organisation’s requirements.
5. Scan History
Once the scan is complete, open it from Scan History. Its page shows the policy verdict, how many findings, components and files it found, and a link to the Review workspace.
6. Review Workspace
On the left, you can explore findings by file, either through a folder tree or grouped by component.
7. Investigating a Finding
In the centre, you investigate each finding. The file header shows the filename, how much of it matches, and the matched component’s version. Below it is your code, and Compare to OSS puts it side by side with the matched open source file. The decision buttons sit right under the code, so you can decide without leaving the file.
8. Finding Metadata
For each component, the panel on the right shows the relevant metadata. This includes the evidence type, such as a snippet or full-file match, the component’s known vulnerabilities, its licences, its versions, and the remediation Earnie suggests, such as the version to upgrade to. You can also see the audit trail, giving you a clear history of the actions taken on that finding.
9. Taking Action on a Finding
From these findings, you can then take action. You can confirm the match, mark the code as original, replace it with a different component, or mark it as not a match. Bulk decide applies one decision to every finding in a group, giving you a clear path from detection to decision.
10. The Policy Page
Navigating to the Policy page, you can see all the policies currently active across your scanned projects. To add one, select New policy. It opens the template catalogue, which you can filter by framework, such as PCI DSS 4.0 or the Cyber Resilience Act, by domain, and by action. Each template is a predefined policy you can then customise. Alternatively, select Start from scratch to write your own.
11. Inside a Policy
Clicking into a policy gives you a complete view of what’s happening. The Overview tab provides a summary, while the Violations tab shows which components are causing policy violations. From there, you can inspect the violation in more detail or request an approval, which can then be managed from the Approvals tab. The Evaluations tab lists each run of the policy: what triggered it, and how many findings it evaluated and matched. The Changes tab gives you a full audit trail of the policy: who created it, edited it, or turned it on or off, and when.
12. Reports
The Reports page lists every export of the project, by scan: SBOMs, xBOMs and compliance reports. Each export captures the state of your project at the scan it comes from. As your project evolves, new findings will appear and different decisions may need to be made based on those findings, so each export gives you a clear view of where your project stood at that point in time.
13. Connecting a Coding Agent via MCP
Under Settings, you can set up the MCP connection through the API Keys tab. Simply generate a key for your coding agent, copy the relevant command for the tool you’re using, and run it directly in your terminal.