> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scanoss.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Advanced Analysis

> This guide walks you through extending your SCANOSS analysis with cryptography and security scanning. You'll learn how to detect cryptographic algorithms, identify vulnerabilities and generate comprehensive reports.

This walkthrough covers two datasets that [Desktop Integration](/en/latest/poc/evaluation/desktop-integration) and [CI/CD Integration](cicd-integration) don't: encryption and vulnerabilities. It's Step 3 of the step-by-step path, but every method below works with sample data, so you can follow along even if you're starting here. It shows three different ways to get there: scanning your source directly with the dedicated Crypto Finder CLI, querying the SCANOSS API interactively, or querying it from the command line with SCANOSS-PY. Pick whichever fits how you like to work.

```mermaid theme={null}
graph TD
    Start{Choose Analysis Method}

    Start -->|Dedicated Crypto Scanner| CF[Crypto Finder]
    Start -->|API Testing| Postman[SCANOSS with Postman]
    Start -->|Command Line| CLI[SCANOSS-PY]

    style Start fill:#42A5F5,stroke:#1976D2,stroke-width:3px,color:#fff
    style CF fill:#EC407A,stroke:#C2185B,stroke-width:3px,color:#fff
    style Postman fill:#66BB6A,stroke:#43A047,stroke-width:3px,color:#fff
    style CLI fill:#AB47BC,stroke:#8E24AA,stroke-width:3px,color:#fff

    click CF "#crypto-finder-command-line" "Jump to Crypto Finder"
    click Postman "#scanoss-with-postman" "Jump to SCANOSS with Postman"
    click CLI "#scanoss-py-command-line" "Jump to SCANOSS-PY"
```

## Prerequisites

Before you begin, ensure you have:

* A SCANOSS API key
* Depending on which method you choose below: [Go](https://go.dev/dl/) (for Crypto Finder), [Postman](https://www.postman.com/downloads), or Python with `pip` (for SCANOSS-PY)

> Completed [Desktop Integration](/en/latest/poc/evaluation/desktop-integration)? You can query the components it found. Starting fresh? Every method below also works with sample data or a new scan, so you don't need to complete that guide first.

## Overview

This guide demonstrates different ways to perform advanced analysis with SCANOSS:

* **[Crypto Finder](https://github.com/scanoss/crypto-finder)** Dedicated CLI for deep cryptographic detection, including call-chain tracing into third-party dependencies and CycloneDX CBOM output
* **[SCANOSS API](https://github.com/scanoss/papi)** with **[Postman](https://www.postman.com/)** Interactive API testing for cryptography and vulnerability queries
* **[SCANOSS-PY](https://github.com/scanoss/scanoss.py)** Command-line tool for automated scanning and analysis

Choose the method that best fits your workflow, or use a combination of all three.

## Crypto Finder (Command Line)

SCANOSS-PY queries cryptography data through the SCANOSS API, using the same component-matching approach as license detection. [Crypto Finder](https://github.com/scanoss/crypto-finder) takes a different approach: it's a dedicated CLI, purpose-built for cryptographic detection, that scans your source directly with a rule-based engine (OpenGrep or Semgrep), traces cryptographic usage through your call graph, and can extend that tracing into your third-party dependencies, not just your own code.

### Install Crypto Finder

```bash theme={null}
go install github.com/scanoss/crypto-finder/cmd/crypto-finder@latest
```

**Verify Installation:**

```bash theme={null}
crypto-finder
```

Docker images are also available if you don't have Go installed. See [Installation](/en/latest/cli/crypto-finder/installation) for every install method.

### Configure Your API Key

Crypto Finder needs a SCANOSS API key to fetch its curated, remotely-hosted cryptographic detection rules. Configure it with the `configure` command, so it persists across scans:

```bash theme={null}
crypto-finder configure --api-key $SCANOSS_API_KEY
```

Alternatively, set it as an environment variable:

```bash theme={null}
export SCANOSS_API_KEY=your_api_key_here
```

Both are read automatically on every scan; see [Configuration](/en/latest/cli/crypto-finder/configuration) for the full precedence order and config file format.

### Scan for Cryptography

```bash theme={null}
crypto-finder scan /path/to/your/project
```

This uses SCANOSS's curated, remotely-fetched cryptographic detection rules by default, and writes results as JSON to stdout.

To also trace cryptographic usage into your third-party dependencies:

```bash theme={null}
crypto-finder scan --scan-dependencies /path/to/your/project
```

### Generate a Cryptography Bill of Materials

For a standardised, shareable inventory of cryptographic assets, export as a CycloneDX CBOM instead:

```bash theme={null}
crypto-finder scan --format cyclonedx --output cbom.json /path/to/your/project
```

For the full command reference, output schema, and CI/CD integration, see the [Crypto Finder documentation](/en/latest/cli/crypto-finder/overview).

## SCANOSS with Postman

Postman provides an interactive way to explore the SCANOSS API and understand how advanced analysis works.

### Prerequisites

* [Install Postman](https://www.postman.com/downloads)
* **SCANOSS API Key**
* **Component PURLs** (optional) — the standard identifier SCANOSS uses for software components, e.g. `pkg:github/scanoss/scanoss.py`. See [Package URLs](/en/latest/apis/api-overview#package-urls-purls) for the full format. The steps below include sample PURLs, so you can follow along without your own.

### Setup Postman Environment

**Create Environment Variables:**

1. In Postman, click **Environments** (left sidebar)
2. Click **Create Environment** or **+**
3. Name it "**SCANOSS**"
4. Add these variables:

| Variable   | Value                     |
| ---------- | ------------------------- |
| `base_url` | `https://api.scanoss.com` |
| `api_key`  | `your-api-key-here`       |

5. Activate the environment by clicking the checkmark next to **SCANOSS** in the left panel, or select **SCANOSS** from the environment dropdown in the top right corner

### Query Cryptographic Algorithms

You can query PURLs from your scan results (obtained from [Desktop Integration](/en/latest/poc/evaluation/desktop-integration)) or use the sample PURLs shown below to learn how the API works.

**Single Component Query:**

1. Create a new request by clicking the **+** icon in the tab bar
2. Set request type to **GET**
3. Enter URL:
   ```
   {{base_url}}/v2/cryptography/algorithms/component
   ```
4. Click **Params** tab and add query parameters:
   * **Key:** `purl` **Value:** `pkg:github/scanoss/scanoss.py` (or use a PURL from your scan results)
   * **Key:** `requirement` **Value:** `>1.3.5` (or use a version from your scan results)
5. Click **Authorization** tab and configure:
   * **Auth Type:** Select `API Key`
   * **Key:** `X-Api-Key`
   * **Value:** `{{api_key}}`
   * **Add to:** Ensure it's set to `Header`
6. Click **Send**

**Multiple Components Query:**

1. Create a new request
2. Set request type to **POST**
3. Enter URL:
   ```
   {{base_url}}/v2/cryptography/algorithms/components
   ```
4. Click **Authorization** tab and configure:
   * **Auth Type:** Select `API Key`
   * **Key:** `X-Api-Key`
   * **Value:** `{{api_key}}`
   * **Add to:** Ensure it's set to `Header`
5. Click **Headers** tab and add:
   * **Key:** `Content-Type` **Value:** `application/json`
6. Click **Body** tab, select **raw** and **JSON**
7. Enter request body:
   ```json theme={null}
   {
     "components": [
       {
         "purl": "pkg:github/scanoss/engine@>=5.0.0"
       },
       {
         "purl": "pkg:github/scanoss/scanoss.py@~1.30.0"
       }
     ]
   }
   ```
8. Click **Send**

### Query Cryptographic Hints

Hints reveal the encryption libraries, protocols and SDKs used by components.

1. Create a new request
2. Set request type to **GET**
3. Enter URL:
   ```
   {{base_url}}/v2/cryptography/hints/component
   ```
4. Add query parameters:
   * **Key:** `purl` **Value:** `pkg:github/scanoss/scanoss.py`
   * **Key:** `requirement` **Value:** `v1.19.5`
5. Click **Authorization** tab and configure:
   * **Auth Type:** Select `API Key`
   * **Key:** `X-Api-Key`
   * **Value:** `{{api_key}}`
   * **Add to:** Ensure it's set to `Header`
6. Click **Send**

**Expected Response:**

```json theme={null}
{
  "component": {
    "purl": "pkg:github/scanoss/scanoss.py",
    "version": "v1.19.5",
    "requirement": "v1.19.5",
    "hints": [
      {
        "id": "library/openssl",
        "name": "OpenSSL",
        "description": "A robust, full-featured open-source toolkit implementing the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols.",
        "category": "library",
        "url": "https://www.openssl.org/docs/",
        "purl": "pkg:github/openssl/openssl"
      },
      {
        "id": "protocol/https",
        "name": "HTTPS",
        "description": "HTTPS (Hypertext Transfer Protocol Secure) is a protocol for secure communication over a computer network",
        "category": "library",
        "url": "",
        "purl": ""
      },
      {
        "id": "protocol/OAuth",
        "name": "Open Authorization",
        "description": "N/A",
        "category": "protocol",
        "url": "",
        "purl": ""
      }
    ]
  },
  "status": {
    "status": "SUCCESS",
    "message": "Cryptographic hints Successfully retrieved"
  }
}
```

### Other Cryptography Endpoints

The [Cryptography API](/en/latest/apis/encryption-api) covers more ground than the two queries above. Set these up in Postman the same way, just change the method and URL:

| Method | Endpoint                                               | Purpose                                                                                                         |
| ------ | ------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------- |
| `GET`  | `/v2/cryptography/algorithms/range/component`          | All algorithms detected across a version range, useful for auditing when cryptography was introduced or changed |
| `GET`  | `/v2/cryptography/algorithms/versions/range/component` | Which versions of a component do and don't contain cryptographic algorithms                                     |
| `POST` | `/v2/cryptography/hints/components`                    | Cryptographic hints for multiple components in one request                                                      |

Each of these also has a batch (`/components`) equivalent for querying multiple components at once. See the [Cryptography API](/en/latest/apis/encryption-api) reference for full request and response formats.

### Query Vulnerabilities

**Single Component Vulnerability Query:**

1. Create a new request
2. Set request type to **GET**
3. Enter URL:
   ```
   {{base_url}}/v2/vulnerabilities/component
   ```
4. Add query parameters:
   * **Key:** `purl` **Value:** `pkg:npm/lodash`
   * **Key:** `requirement` **Value:** `4.17.20`
5. Click **Authorization** tab and configure:
   * **Auth Type:** Select `API Key`
   * **Key:** `X-Api-Key`
   * **Value:** `{{api_key}}`
   * **Add to:** Ensure it's set to `Header`
6. Click **Send**

**Expected Response:**

```json theme={null}
{
  "component": {
    "purl": "pkg:npm/lodash",
    "version": "4.17.20",
    "requirement": "4.17.20",
    "vulnerabilities": [
      {
        "id": "CVE-2020-28500",
        "cve": "CVE-2020-28500",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28500",
        "summary": "Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via ...",
        "severity": "MEDIUM",
        "published": "2021-02-15",
        "modified": "2024-11-21",
        "source": "NVD",
        "cvss": []
      },
      {
        "id": "CVE-2021-23337",
        "cve": "CVE-2021-23337",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23337",
        "summary": "Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.",
        "severity": "HIGH",
        "published": "2021-02-15",
        "modified": "2024-11-21",
        "source": "NVD",
        "cvss": []
      },
      {
        "id": "GHSA-29mw-wpgm-hmr9",
        "cve": "CVE-2020-28500",
        "url": "https://osv.dev/vulnerability/CVE-2020-28500",
        "summary": "Regular Expression Denial of Service (ReDoS) in lodash",
        "severity": "MODERATE",
        "published": "2022-01-06",
        "modified": "2025-09-29",
        "source": "OSV",
        "cvss": [
          {
            "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "cvss_score": 5.3,
            "cvss_severity": "MEDIUM"
          }
        ]
      },
      {
        "id": "GHSA-35jh-r3h4-6jhm",
        "cve": "CVE-2021-23337",
        "url": "https://osv.dev/vulnerability/CVE-2021-23337",
        "summary": "Command Injection in lodash",
        "severity": "HIGH",
        "published": "2021-05-06",
        "modified": "2025-08-12",
        "source": "OSV",
        "cvss": [
          {
            "cvss": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "cvss_score": 7.2,
            "cvss_severity": "HIGH"
          }
        ]
      }
    ]
  },
  "status": {
    "status": "SUCCESS",
    "message": "Success"
  }
}
```

**Multiple Components Vulnerability Query:**

1. Create a new request
2. Set request type to **POST**
3. Enter URL:
   ```
   {{base_url}}/v2/vulnerabilities/components
   ```
4. Click **Authorization** tab and configure:
   * **Auth Type:** Select `API Key`
   * **Key:** `X-Api-Key`
   * **Value:** `{{api_key}}`
   * **Add to:** Ensure it's set to `Header`
5. Click **Headers** tab and add:
   * **Key:** `Content-Type` **Value:** `application/json`
6. Click **Body** tab, select **raw** and **JSON**, then add body:
   ```json theme={null}
   {
     "components": [
       {
         "purl": "pkg:npm/lodash",
         "requirement": "4.17.20"
       },
       {
         "purl": "pkg:pypi/requests",
         "requirement": "2.25.0"
       }
     ]
   }
   ```
7. Click **Send**

### Other Vulnerability Endpoints

The [Vulnerability API](/en/latest/apis/vulnerability-api) also provides CPE identifiers, useful for cross-referencing components against vulnerability databases outside SCANOSS:

| Method | Endpoint                              | Purpose                                                |
| ------ | ------------------------------------- | ------------------------------------------------------ |
| `GET`  | `/v2/vulnerabilities/cpes/component`  | CPE identifiers for a single component                 |
| `POST` | `/v2/vulnerabilities/cpes/components` | CPE identifiers for multiple components in one request |

See the [Vulnerability API](/en/latest/apis/vulnerability-api) reference for full request and response formats.

### Save Postman Collection

To reuse these requests:

1. Click **Collections** (left sidebar)
2. Click **Create Collection** or **+**
3. Name it "**SCANOSS Advanced Analysis**"
4. Click into each of your requests, then click save request o nthe right hand side, select the collection and click save
5. Click **...** next to collection name > **More** > **Export** > **Continue with Export** > **Export JSON**
6. Share the exported JSON with your team

For additional details, refer to the following documentation:

* [Cryptography API](/en/latest/apis/encryption-api)
* [Vulnerability API](/en/latest/apis/vulnerability-api)

## SCANOSS-PY (Command Line)

SCANOSS-PY provides powerful command-line capabilities for automated scanning and analysis.

Haven't installed it yet? `pip install scanoss` (see [Desktop Integration](/en/latest/poc/evaluation/desktop-integration#install-scanoss-py) for the full walkthrough, including verifying the install).

### Detect Cryptographic Algorithms

You have two options for analysing cryptography, using the existing scan results or performing a new scan with focus on cryptographic detection.

**Analyze Existing Scan Results**

If you already have scan results from [Desktop Integration](/en/latest/poc/evaluation/desktop-integration), examine them for cryptography information:

```bash theme={null}
# View cryptography information for all components
cat .scanoss/results.json | jq '.[].[] | select(.cryptography != null) | {file: .file, component: .component, crypto: .cryptography}'
```

**Run a Fresh Scan**

Navigate to your project directory and run a new scan:

```bash theme={null}
cd /path/to/your/project

scanoss-py scan . \
  --dependencies \
  --output .scanoss/results.json \
  --key $SCANOSS_API_KEY
```

This scan generates a `results.json` file containing component metadata including PURLs, versions and detected cryptography information.

### Query Cryptographic Algorithms

After identifying components with cryptography, you can query detailed algorithm information.

**Extract Component PURLs:**

```bash theme={null}
# Extract all PURLs with versions from your scan results
jq -r '.[].[] | select(.purl != null) | .purl[] as $purl | "\($purl)@\(.version)"' .scanoss/results.json

# Save PURLs to file for batch processing
jq -r '.[].[] | select(.purl != null) | .purl[] as $purl | "\($purl)@\(.version)"' .scanoss/results.json > purls.txt
```

**Query Single Component:**

Get specific algorithm details for a component you're interested in (use a PURL from your scan results or try the sample below):

```bash theme={null}
scanoss-py crypto algorithms \
  --purl "pkg:github/scanoss/engine@5.0.0" \
  --key $SCANOSS_API_KEY
```

**Query Multiple Components:**

For analysing multiple components at once, create a PURL input file:

```bash theme={null}
# Create PURL input file
cat > purl-list.json << 'EOF'
{
  "purls": [
    {
      "purl": "pkg:github/scanoss/engine@>=5.0.0"
    },
    {
      "purl": "pkg:github/scanoss/scanoss.py@~1.30.0"
    }
  ]
}
EOF
```

```bash theme={null}
# Query all components
scanoss-py crypto algorithms \
  --input purl-list.json \
  --key $SCANOSS_API_KEY
```

### Query Cryptographic Hints

Cryptographic hints reveal the encryption libraries, protocols and SDKs used by your components:

```bash theme={null}
scanoss-py crypto hints \
  --purl "pkg:github/scanoss/scanoss.py@v1.19.5" \
  --key $SCANOSS_API_KEY
```

For additional command-line options and examples, refer to the [`crypto` command reference](/en/latest/cli/scanoss-py/commands-and-arguments#crypto).

### Query Vulnerabilities

Vulnerability analysis identifies known security issues (CVEs) in your open source components, helping you prioritise security fixes.

**Query Single Component:**

```bash theme={null}
scanoss-py comp vulns \
  --purl "pkg:npm/lodash@4.17.20" \
  --key $SCANOSS_API_KEY
```

**Query Multiple Components:**

For comprehensive vulnerability analysis across all your components:

```bash theme={null}
# Create PURL input file
cat > purl-list.json << 'EOF'
{
  "components": [
    {
      "purl": "pkg:npm/lodash@4.17.20"
    },
    {
      "purl": "pkg:pypi/requests@2.25.0"
    }
  ]
}
EOF
```

```bash theme={null}
# Query all components
scanoss-py comp vulns \
  -i purl-list.json \
  --key $SCANOSS_API_KEY
```

For detailed command-line options and additional examples, refer to the [`vulns` command reference](/en/latest/cli/scanoss-py/commands-and-arguments#vulns).

## What's Next

With encryption and vulnerability detection covered, the last piece is turning this from a one-time scan into ongoing tracking: [Continuous Monitoring](/en/latest/poc/evaluation/continuous-monitoring).

Need help? [Contact our AI assistant](?assistant=open)