What Earnie Does
Most tools stop at detection, they hand you a list of matches, licences, or vulnerabilities and leave it there. Earnie is built around what happens after the list. Someone has to look at each item, decide what it is, record why and be able to prove that decision months later when a customer or an auditor asks. Earnie is one unified control plane over every line of code, human or AI, governing three domains of risk which is open source, cryptography, and AI. Earnie enforces one policy across every surface a change passes through, coding agents, pull requests, and the audit trail.The Shape of the Work
Everything in Earnie follows the same chain, and it’s worth learning the five words now because every screen uses them:
A scan reads your code, fingerprints it, matches it against the SCANOSS knowledgebase, and enriches what it found with licence, vulnerability, and provenance data. That decorated finding is then evaluated against your policies, which produce a verdict.
Three Moments, One Set of Rules
You write a policy once, and Earnie applies it wherever the question comes up:- While code is being written — coding tools and agents can ask Earnie what your policy says before a dependency is even added, over MCP.
- When a change is proposed — a pull request gets the findings based on the code changes it introduces, along with a clear pass, warn, or block signal.
- Any time afterwards — you review the whole project, export inventories, and show the decision history.
Your code stays yours. Earnie never uploads your source. It fingerprints
files locally and sends only those fingerprints and hashes to SCANOSS for
matching. What comes back is intelligence about your code, not a copy of it.
Who Uses Earnie
- Operators — Heads of AppSec, Security Engineering, Platform, or OSPO leads — sign in to the console to triage findings, set policy, and manage the team.
- Developers and coding agents — interact through MCP, PR checks, the CLI, and the API. They don’t need a seat in the console.
- Record consumers — CISOs, IP/technical counsel, and AI risk owners — consume what Earnie exports (SBOMs, attribution documents, the audit log) without using the product directly.
What’s Next
The rest of this guide follows one example project end to end, connecting a repository, running a first scan, triaging findings in the Review Workspace, writing a policy, and exporting the evidence as an SBOM. Each chapter picks up where the last one left off.Jump to a Section
Getting Started
Workspace Setup
Sign in with SSO and complete the six-step setup wizard.
Connecting a Repository
What access Earnie asks for, and how the GitHub App connection is made.
First Scan
How a scan runs, and what full versus partial coverage means.
Using Earnie
Dashboard
The one screen that tells you whether you can ship.
All Projects
The same posture, ranked across your whole organisation at once.
Triaging Findings
Work the Review Workspace backlog and record a decision.
Setting Policies
Turn a judgement call you keep repeating into a rule that applies itself.
Merge Gate
The three routes available when a policy blocks a merge.
Earnie CLI
Authenticate, scan, and read verdicts and policies from a pipeline or a coding agent.
Evidence
Exporting SBOMs
Generate an SBOM snapshot and render an Attribution Document.
Audit Log
Prove why a component was accepted, months later.
Administration
Team & Roles
The three roles Earnie uses, and who can do what.
API Keys
Authenticate pipelines and scripts without a person’s account.