scanoss

What it is and what it does

Scanoss is a Python library that scans source code to identify open-source components, their licenses, and known vulnerabilities by fingerprinting files and matching them against the SCANOSS open-source knowledge base. It works both as a command-line tool and as a library you can import into your own Python projects.

The package handles the full workflow of code analysis: fingerprinting source files, submitting them to the SCANOSS API (defaulting to the free OSS KB at api.osskb.org), and parsing results to identify components and their metadata. It supports custom API endpoints and keys, optional fast fingerprinting via an external winnowing package, and dependency decoration when scancode-toolkit is installed. The 16 runtime dependencies handle HTTP requests, protocol buffers for API communication, file introspection, and SBOM generation.

Use it for:

• Scan a codebase to generate a software bill of materials (SBOM) identifying all open-source components
• Check source code for known security vulnerabilities in dependencies before deployment
• Audit license compliance by identifying all open-source licenses present in a project
• Fingerprint and match code fragments to detect reused or derivative open-source software
• Integrate component detection into a CI/CD pipeline to block builds with unacceptable licenses or vulnerabilities

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Scanoss provides a Python library and CLI tool to fingerprint source code and scan it against the SCANOSS open-source knowledge base to identify components, licenses, and security issues.

Yes. Scanoss is actively maintained, has low install friction, carries a permissive MIT license, and solves a real problem in software supply chain security and compliance. It integrates easily into Python projects or runs standalone. No known vulnerabilities. Suitable for teams needing open-source component tracking and license auditing.

Install

scanoss on PyPI

pip install scanoss

uv add scanoss

poetry add scanoss

Installing scanoss

Before you install

Low install friction with a pure-Python wheel distribution. Active maintenance with a recent release (24 days old) and ongoing repository activity. Requires Python 3.9 or higher.

License in practice

MIT license permits unrestricted use, modification, and distribution with minimal restrictions—suitable for both open-source and commercial projects.

Quickstart

pip install scanoss

from scanoss.scanner import Scanner

scanner = Scanner()
scanner.scan_folder('.')

Requires Python 3.9 or higher. Optional: install scanoss_winnowing or scancode-toolkit for enhanced fingerprinting and dependency decoration.

Verify before relying

• Accuracy and completeness of component matching against the SCANOSS knowledge base
• Performance characteristics when scanning large codebases
• API rate limits and availability guarantees for the default OSS KB endpoint

Package facts

Evidence: scanoss-1.54.2-py3-none-any.whl

Tags

More Quality Assurance packages