Advanced Analysis - SCANOSS documentation

This walkthrough covers two datasets that Desktop Integration and CI/CD Integration don’t: encryption and vulnerabilities. It’s Step 3 of the step-by-step path, but every method below works with sample data, so you can follow along even if you’re starting here. It shows three different ways to get there: scanning your source directly with the dedicated Crypto Finder CLI, querying the SCANOSS API interactively, or querying it from the command line with SCANOSS-PY. Pick whichever fits how you like to work.

Prerequisites

Before you begin, ensure you have:

A SCANOSS API key
Depending on which method you choose below: Go (for Crypto Finder), Postman, or Python with pip (for SCANOSS-PY)

Completed Desktop Integration? You can query the components it found. Starting fresh? Every method below also works with sample data or a new scan, so you don’t need to complete that guide first.

Overview

This guide demonstrates different ways to perform advanced analysis with SCANOSS:

Crypto Finder Dedicated CLI for deep cryptographic detection, including call-chain tracing into third-party dependencies and CycloneDX CBOM output
SCANOSS API with Postman Interactive API testing for cryptography and vulnerability queries
SCANOSS-PY Command-line tool for automated scanning and analysis

Choose the method that best fits your workflow, or use a combination of all three.

Crypto Finder (Command Line)

SCANOSS-PY queries cryptography data through the SCANOSS API, using the same component-matching approach as license detection. Crypto Finder takes a different approach: it’s a dedicated CLI, purpose-built for cryptographic detection, that scans your source directly with a rule-based engine (OpenGrep or Semgrep), traces cryptographic usage through your call graph, and can extend that tracing into your third-party dependencies, not just your own code.

Install Crypto Finder

go install github.com/scanoss/crypto-finder/cmd/crypto-finder@latest

Verify Installation:

crypto-finder

Docker images are also available if you don’t have Go installed. See Installation for every install method.

Configure Your API Key

Crypto Finder needs a SCANOSS API key to fetch its curated, remotely-hosted cryptographic detection rules. Configure it with the configure command, so it persists across scans:

crypto-finder configure --api-key $SCANOSS_API_KEY

Alternatively, set it as an environment variable:

export SCANOSS_API_KEY=your_api_key_here

Both are read automatically on every scan; see Configuration for the full precedence order and config file format.

Scan for Cryptography

crypto-finder scan /path/to/your/project

This uses SCANOSS’s curated, remotely-fetched cryptographic detection rules by default, and writes results as JSON to stdout. To also trace cryptographic usage into your third-party dependencies:

crypto-finder scan --scan-dependencies /path/to/your/project

Generate a Cryptography Bill of Materials

For a standardised, shareable inventory of cryptographic assets, export as a CycloneDX CBOM instead:

crypto-finder scan --format cyclonedx --output cbom.json /path/to/your/project

For the full command reference, output schema, and CI/CD integration, see the Crypto Finder documentation.

SCANOSS with Postman

Postman provides an interactive way to explore the SCANOSS API and understand how advanced analysis works.

Prerequisites

Install Postman
SCANOSS API Key
Component PURLs (optional) — the standard identifier SCANOSS uses for software components, e.g. pkg:github/scanoss/scanoss.py. See Package URLs for the full format. The steps below include sample PURLs, so you can follow along without your own.

Setup Postman Environment

Create Environment Variables:

In Postman, click Environments (left sidebar)
Click Create Environment or +
Name it “SCANOSS”
Add these variables:

Variable	Value
`base_url`	`https://api.scanoss.com`
`api_key`	`your-api-key-here`

Activate the environment by clicking the checkmark next to SCANOSS in the left panel, or select SCANOSS from the environment dropdown in the top right corner

Query Cryptographic Algorithms

You can query PURLs from your scan results (obtained from Desktop Integration) or use the sample PURLs shown below to learn how the API works. Single Component Query:

Create a new request by clicking the + icon in the tab bar
Set request type to GET

Enter URL:

{{base_url}}/v2/cryptography/algorithms/component

Click Params tab and add query parameters:
- Key: purl Value: pkg:github/scanoss/scanoss.py (or use a PURL from your scan results)
- Key: requirement Value: >1.3.5 (or use a version from your scan results)
Click Authorization tab and configure:
- Auth Type: Select API Key
- Key: X-Api-Key
- Value: {{api_key}}
- Add to: Ensure it’s set to Header
Click Send

Multiple Components Query:

Create a new request
Set request type to POST

Enter URL:

{{base_url}}/v2/cryptography/algorithms/components

Click Authorization tab and configure:
- Auth Type: Select API Key
- Key: X-Api-Key
- Value: {{api_key}}
- Add to: Ensure it’s set to Header
Click Headers tab and add:
- Key: Content-Type Value: application/json
Click Body tab, select raw and JSON

Enter request body:

{
  "components": [
    {
      "purl": "pkg:github/scanoss/engine@>=5.0.0"
    },
    {
      "purl": "pkg:github/scanoss/scanoss.py@~1.30.0"
    }
  ]
}

Click Send

Query Cryptographic Hints

Hints reveal the encryption libraries, protocols and SDKs used by components.

Create a new request
Set request type to GET

Enter URL:

{{base_url}}/v2/cryptography/hints/component

Add query parameters:
- Key: purl Value: pkg:github/scanoss/scanoss.py
- Key: requirement Value: v1.19.5
Click Authorization tab and configure:
- Auth Type: Select API Key
- Key: X-Api-Key
- Value: {{api_key}}
- Add to: Ensure it’s set to Header
Click Send

Expected Response:

{
  "component": {
    "purl": "pkg:github/scanoss/scanoss.py",
    "version": "v1.19.5",
    "requirement": "v1.19.5",
    "hints": [
      {
        "id": "library/openssl",
        "name": "OpenSSL",
        "description": "A robust, full-featured open-source toolkit implementing the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols.",
        "category": "library",
        "url": "https://www.openssl.org/docs/",
        "purl": "pkg:github/openssl/openssl"
      },
      {
        "id": "protocol/https",
        "name": "HTTPS",
        "description": "HTTPS (Hypertext Transfer Protocol Secure) is a protocol for secure communication over a computer network",
        "category": "library",
        "url": "",
        "purl": ""
      },
      {
        "id": "protocol/OAuth",
        "name": "Open Authorization",
        "description": "N/A",
        "category": "protocol",
        "url": "",
        "purl": ""
      }
    ]
  },
  "status": {
    "status": "SUCCESS",
    "message": "Cryptographic hints Successfully retrieved"
  }
}

Other Cryptography Endpoints

The Cryptography API covers more ground than the two queries above. Set these up in Postman the same way, just change the method and URL:

Method	Endpoint	Purpose
`GET`	`/v2/cryptography/algorithms/range/component`	All algorithms detected across a version range, useful for auditing when cryptography was introduced or changed
`GET`	`/v2/cryptography/algorithms/versions/range/component`	Which versions of a component do and don’t contain cryptographic algorithms
`POST`	`/v2/cryptography/hints/components`	Cryptographic hints for multiple components in one request

Each of these also has a batch (/components) equivalent for querying multiple components at once. See the Cryptography API reference for full request and response formats.

Query Vulnerabilities

Single Component Vulnerability Query:

Create a new request
Set request type to GET

Enter URL:

{{base_url}}/v2/vulnerabilities/component

Add query parameters:
- Key: purl Value: pkg:npm/lodash
- Key: requirement Value: 4.17.20
Click Authorization tab and configure:
- Auth Type: Select API Key
- Key: X-Api-Key
- Value: {{api_key}}
- Add to: Ensure it’s set to Header
Click Send

Expected Response:

{
  "component": {
    "purl": "pkg:npm/lodash",
    "version": "4.17.20",
    "requirement": "4.17.20",
    "vulnerabilities": [
      {
        "id": "CVE-2020-28500",
        "cve": "CVE-2020-28500",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28500",
        "summary": "Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via ...",
        "severity": "MEDIUM",
        "published": "2021-02-15",
        "modified": "2024-11-21",
        "source": "NVD",
        "cvss": []
      },
      {
        "id": "CVE-2021-23337",
        "cve": "CVE-2021-23337",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23337",
        "summary": "Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.",
        "severity": "HIGH",
        "published": "2021-02-15",
        "modified": "2024-11-21",
        "source": "NVD",
        "cvss": []
      },
      {
        "id": "GHSA-29mw-wpgm-hmr9",
        "cve": "CVE-2020-28500",
        "url": "https://osv.dev/vulnerability/CVE-2020-28500",
        "summary": "Regular Expression Denial of Service (ReDoS) in lodash",
        "severity": "MODERATE",
        "published": "2022-01-06",
        "modified": "2025-09-29",
        "source": "OSV",
        "cvss": [
          {
            "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "cvss_score": 5.3,
            "cvss_severity": "MEDIUM"
          }
        ]
      },
      {
        "id": "GHSA-35jh-r3h4-6jhm",
        "cve": "CVE-2021-23337",
        "url": "https://osv.dev/vulnerability/CVE-2021-23337",
        "summary": "Command Injection in lodash",
        "severity": "HIGH",
        "published": "2021-05-06",
        "modified": "2025-08-12",
        "source": "OSV",
        "cvss": [
          {
            "cvss": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "cvss_score": 7.2,
            "cvss_severity": "HIGH"
          }
        ]
      }
    ]
  },
  "status": {
    "status": "SUCCESS",
    "message": "Success"
  }
}

Multiple Components Vulnerability Query:

Create a new request
Set request type to POST

Enter URL:

{{base_url}}/v2/vulnerabilities/components

Click Authorization tab and configure:
- Auth Type: Select API Key
- Key: X-Api-Key
- Value: {{api_key}}
- Add to: Ensure it’s set to Header
Click Headers tab and add:
- Key: Content-Type Value: application/json

Click Body tab, select raw and JSON, then add body:

{
  "components": [
    {
      "purl": "pkg:npm/lodash",
      "requirement": "4.17.20"
    },
    {
      "purl": "pkg:pypi/requests",
      "requirement": "2.25.0"
    }
  ]
}

Click Send

Other Vulnerability Endpoints

The Vulnerability API also provides CPE identifiers, useful for cross-referencing components against vulnerability databases outside SCANOSS:

Method	Endpoint	Purpose
`GET`	`/v2/vulnerabilities/cpes/component`	CPE identifiers for a single component
`POST`	`/v2/vulnerabilities/cpes/components`	CPE identifiers for multiple components in one request

See the Vulnerability API reference for full request and response formats.

Save Postman Collection

To reuse these requests:

Click Collections (left sidebar)
Click Create Collection or +
Name it “SCANOSS Advanced Analysis”
Click into each of your requests, then click save request o nthe right hand side, select the collection and click save
Click … next to collection name > More > Export > Continue with Export > Export JSON
Share the exported JSON with your team

For additional details, refer to the following documentation:

SCANOSS-PY (Command Line)

SCANOSS-PY provides powerful command-line capabilities for automated scanning and analysis. Haven’t installed it yet? pip install scanoss (see Desktop Integration for the full walkthrough, including verifying the install).

Detect Cryptographic Algorithms

You have two options for analysing cryptography, using the existing scan results or performing a new scan with focus on cryptographic detection. Analyze Existing Scan Results If you already have scan results from Desktop Integration, examine them for cryptography information:

# View cryptography information for all components
cat .scanoss/results.json | jq '.[].[] | select(.cryptography != null) | {file: .file, component: .component, crypto: .cryptography}'

Run a Fresh Scan Navigate to your project directory and run a new scan:

cd /path/to/your/project

scanoss-py scan . \
  --dependencies \
  --output .scanoss/results.json \
  --key $SCANOSS_API_KEY

This scan generates a results.json file containing component metadata including PURLs, versions and detected cryptography information.

Query Cryptographic Algorithms

After identifying components with cryptography, you can query detailed algorithm information. Extract Component PURLs:

# Extract all PURLs with versions from your scan results
jq -r '.[].[] | select(.purl != null) | .purl[] as $purl | "\($purl)@\(.version)"' .scanoss/results.json

# Save PURLs to file for batch processing
jq -r '.[].[] | select(.purl != null) | .purl[] as $purl | "\($purl)@\(.version)"' .scanoss/results.json > purls.txt

Query Single Component: Get specific algorithm details for a component you’re interested in (use a PURL from your scan results or try the sample below):

scanoss-py crypto algorithms \
  --purl "pkg:github/scanoss/engine@5.0.0" \
  --key $SCANOSS_API_KEY

Query Multiple Components: For analysing multiple components at once, create a PURL input file:

# Create PURL input file
cat > purl-list.json << 'EOF'
{
  "purls": [
    {
      "purl": "pkg:github/scanoss/engine@>=5.0.0"
    },
    {
      "purl": "pkg:github/scanoss/scanoss.py@~1.30.0"
    }
  ]
}
EOF

# Query all components
scanoss-py crypto algorithms \
  --input purl-list.json \
  --key $SCANOSS_API_KEY

Query Cryptographic Hints

Cryptographic hints reveal the encryption libraries, protocols and SDKs used by your components:

scanoss-py crypto hints \
  --purl "pkg:github/scanoss/scanoss.py@v1.19.5" \
  --key $SCANOSS_API_KEY

For additional command-line options and examples, refer to the crypto command reference.

Query Vulnerabilities

Vulnerability analysis identifies known security issues (CVEs) in your open source components, helping you prioritise security fixes. Query Single Component:

scanoss-py comp vulns \
  --purl "pkg:npm/lodash@4.17.20" \
  --key $SCANOSS_API_KEY

Query Multiple Components: For comprehensive vulnerability analysis across all your components:

# Create PURL input file
cat > purl-list.json << 'EOF'
{
  "components": [
    {
      "purl": "pkg:npm/lodash@4.17.20"
    },
    {
      "purl": "pkg:pypi/requests@2.25.0"
    }
  ]
}
EOF

# Query all components
scanoss-py comp vulns \
  -i purl-list.json \
  --key $SCANOSS_API_KEY

For detailed command-line options and additional examples, refer to the vulns command reference.

What’s Next

With encryption and vulnerability detection covered, the last piece is turning this from a one-time scan into ongoing tracking: Continuous Monitoring. Need help? Contact our AI assistant

​Prerequisites

​Overview

​Crypto Finder (Command Line)

​Install Crypto Finder

​Configure Your API Key

​Scan for Cryptography

​Generate a Cryptography Bill of Materials

​SCANOSS with Postman

​Prerequisites

​Setup Postman Environment

​Query Cryptographic Algorithms

​Query Cryptographic Hints

​Other Cryptography Endpoints

​Query Vulnerabilities

​Other Vulnerability Endpoints

​Save Postman Collection

​SCANOSS-PY (Command Line)

​Detect Cryptographic Algorithms

​Query Cryptographic Algorithms

​Query Cryptographic Hints

​Query Vulnerabilities

​What’s Next

Prerequisites

Overview

Crypto Finder (Command Line)

Install Crypto Finder

Configure Your API Key

Scan for Cryptography

Generate a Cryptography Bill of Materials

SCANOSS with Postman

Prerequisites

Setup Postman Environment

Query Cryptographic Algorithms

Query Cryptographic Hints

Other Cryptography Endpoints

Query Vulnerabilities

Other Vulnerability Endpoints

Save Postman Collection

SCANOSS-PY (Command Line)

Detect Cryptographic Algorithms

Query Cryptographic Algorithms

Query Cryptographic Hints

Query Vulnerabilities

What’s Next