Skip to main content
Use Scan to generate a software bill of materials (SBOM), audit dependencies, or enforce a license policy in CI. The githits-scan command finds lockfiles and manifests in your repository and sends them to GitHits for analysis. You can run Scan from a terminal or CI. Install it separately from the githits CLI and MCP server.
Alpha. These pages cover githits-scan 0.3.0. Commands and JSON can change before 1.0. Pin a released version in CI and review migration notes before upgrading.Scan uses the experimental lockfile-jobs API. The v1 API contract is not finalized, and license report JSON uses experimental schema 2.

​
Start with a local preview

Install Scan, then run this command from the repository you want to scan:
detect shows which package files Scan would upload. It reads those files locally and makes no API request. You don’t need a token for this step. Review the selection and the file contents before continuing. Then set your API token and choose the report you need: The default SBOM format is CycloneDX 1.7 JSON. You can also choose SPDX 2.3 tag-value or a text inventory. An audit checks vulnerabilities, deprecated releases, outdated and duplicate versions, and manifest/lockfile disagreements. A license report is informational. To enforce a policy with license check, configure the licenses you allow first. GitHits parses the uploaded files and resolves dependencies. Scan checks upload limits and writes the returned reports. Use the command reference for output formats, flags, and exit codes.

​
Review what you upload

Upload commands send the full contents of selected lockfiles and manifests, with paths relative to the scan root. Package files can contain private package names, registry URLs, and other sensitive values. Scan does not redact their contents. Review both detect and the selected files before uploading. The detect preview prepares the same files as upload commands, including eligible Cargo and npm workspace member manifests. Scan does not upload source files outside its supported package files, Git history, or githits-scan.toml. It has no telemetry or analytics reporting. You can also work with saved reports without a token or network connection: audit --from-analysis, license report --from-report, and license check --sbom. Reports can reveal dependency names and paths. Review them before sharing. Read the Privacy Policy and Terms of Service for how GitHits processes submitted data.

​
Set up repeatable checks

Save a reviewed inventory to record which projects you intend to scan. Scan can then stop a CI run when that inventory changes. The CI guide shows how to generate an SBOM and check its licenses with a pinned Scan version. For an integration that submits files and manages analysis jobs directly, use the HTTP API. Its reference covers upload limits, quota rules, and how to interpret results. If a command fails, use the troubleshooting guide to check its exit code and diagnostic message.