---
id: scanoss
version: "1.54.2"
license: MIT
license_treatment: permissive
maintenance: active
---

# scanoss — Simple Python library to leverage the SCANOSS APIs

License: permissive · Maintenance: active · Downloads: 102.1K/mo

## What it is and what it does

Scanoss is a Python library that scans source code to identify open-source components, their licenses, and known vulnerabilities by fingerprinting files and matching them against the SCANOSS open-source knowledge base. It works both as a command-line tool and as a library you can import into your own Python projects.

The package handles the full workflow of code analysis: fingerprinting source files, submitting them to the SCANOSS API (defaulting to the free OSS KB at api.osskb.org), and parsing results to identify components and their metadata. It supports custom API endpoints and keys, optional fast fingerprinting via an external winnowing package, and dependency decoration when scancode-toolkit is installed. The 16 runtime dependencies handle HTTP requests, protocol buffers for API communication, file introspection, and SBOM generation.

Use it for:

- Scan a codebase to generate a software bill of materials (SBOM) identifying all open-source components
- Check source code for known security vulnerabilities in dependencies before deployment
- Audit license compliance by identifying all open-source licenses present in a project
- Fingerprint and match code fragments to detect reused or derivative open-source software
- Integrate component detection into a CI/CD pipeline to block builds with unacceptable licenses or vulnerabilities

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Scanoss provides a Python library and CLI tool to fingerprint source code and scan it against the SCANOSS open-source knowledge base to identify components, licenses, and security issues.

Yes. Scanoss is actively maintained, has low install friction, carries a permissive MIT license, and solves a real problem in software supply chain security and compliance. It integrates easily into Python projects or runs standalone. No known vulnerabilities. Suitable for teams needing open-source component tracking and license auditing.

## Install

pip install scanoss
uv add scanoss
poetry add scanoss

## Installing scanoss

Before you install: Low install friction with a pure-Python wheel distribution. Active maintenance with a recent release (24 days old) and ongoing repository activity. Requires Python 3.9 or higher.

License in practice: MIT license permits unrestricted use, modification, and distribution with minimal restrictions—suitable for both open-source and commercial projects.

Quickstart:

pip install scanoss

from scanoss.scanner import Scanner

scanner = Scanner()
scanner.scan_folder('.')

Requires Python 3.9 or higher. Optional: install scanoss_winnowing or scancode-toolkit for enhanced fingerprinting and dependency decoration.

Verify before relying:

- Accuracy and completeness of component matching against the SCANOSS knowledge base
- Performance characteristics when scanning large codebases
- API rate limits and availability guarantees for the default OSS KB endpoint

## Package facts

- License: MIT (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 102.1K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

source code scanning, open source component detection, software composition analysis, license compliance checking, dependency fingerprinting, sbom generation, code provenance, sbom, supply-chain-security, license-compliance

[View on SkillFed](https://skillfed.io/packages/scanoss) · [View on PyPI](https://pypi.org/project/scanoss/)