{"categories":[{"label":"Quality Assurance","url":"https://skillfed.io/packages/category/software-development-quality-assurance/4"}],"enrichment":{"capability":"Scanoss provides a Python library and CLI tool to fingerprint source code and scan it against the SCANOSS open-source knowledge base to identify components, licenses, and security issues.","skillfed_tags":["sbom","supply-chain-security","license-compliance"],"use_cases":["Scan a codebase to generate a software bill of materials (SBOM) identifying all open-source components","Check source code for known security vulnerabilities in dependencies before deployment","Audit license compliance by identifying all open-source licenses present in a project","Fingerprint and match code fragments to detect reused or derivative open-source software","Integrate component detection into a CI/CD pipeline to block builds with unacceptable licenses or vulnerabilities"],"what_it_does":"Scanoss is a Python library that scans source code to identify open-source components, their licenses, and known vulnerabilities by fingerprinting files and matching them against the SCANOSS open-source knowledge base. It works both as a command-line tool and as a library you can import into your own Python projects.\n\nThe package handles the full workflow of code analysis: fingerprinting source files, submitting them to the SCANOSS API (defaulting to the free OSS KB at api.osskb.org), and parsing results to identify components and their metadata. It supports custom API endpoints and keys, optional fast fingerprinting via an external winnowing package, and dependency decoration when scancode-toolkit is installed. The 16 runtime dependencies handle HTTP requests, protocol buffers for API communication, file introspection, and SBOM generation.","worth_installing":"Yes. Scanoss is actively maintained, has low install friction, carries a permissive MIT license, and solves a real problem in software supply chain security and compliance. It integrates easily into Python projects or runs standalone. No known vulnerabilities. Suitable for teams needing open-source component tracking and license auditing."},"id":"scanoss","links":{"html":"https://skillfed.io/packages/scanoss","md":"https://skillfed.io/packages/scanoss.md","pypi":"https://pypi.org/project/scanoss/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2026-07-21","license_spdx":null,"license_treatment":"permissive","name":"scanoss","python_support":"supports_current","summary":"Simple Python library to leverage the SCANOSS APIs"},"popularity":{"monthly_downloads":102123,"position":12889,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"1.54.2"}