> ## Documentation Index
> Fetch the complete documentation index at: https://docs.githits.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Scan your dependencies

> Generate an SBOM, audit dependencies, and check license policy from your repository with githits-scan.

Use Scan to generate a software bill of materials (SBOM), audit dependencies, or enforce a license policy in CI. The `githits-scan` command finds lockfiles and manifests in your repository and sends them to GitHits for analysis.

You can run Scan from a terminal or CI. Install it separately from the [`githits` CLI](https://docs.githits.com/cli/commands) and MCP server.

> [!WARNING]
>
> **Alpha.** These pages cover `githits-scan` 0.3.0. Commands and JSON can change before 1.0. Pin a released version in CI and review migration notes before upgrading.
>
> Scan uses the experimental lockfile-jobs API. The [v1 API contract](https://docs.githits.com/api/versioning.md) is not finalized, and license report JSON uses experimental schema 2.

## Start with a local preview

[Install Scan](https://docs.githits.com/scan/installation.md), then run this command from the repository you want to scan:

```bash theme={null}
githits-scan detect
```

`detect` shows which package files Scan would upload. It reads those files locally and makes no API request. You don't need a token for this step.

Review the selection and the file contents before continuing. Then [set your API token](https://docs.githits.com/scan/installation.md#set-up-authentication) and choose the report you need:

| Task | Command |
| - | - |
| Generate an SBOM | `githits-scan sbom generate -o bom.cdx.json` |
| Audit dependencies | `githits-scan audit` |
| Read license information | `githits-scan license report` |
| Enforce a license policy | `githits-scan license check` |

The default SBOM format is CycloneDX 1.7 JSON. You can also choose SPDX 2.3 tag-value or a text inventory.

An audit checks vulnerabilities, deprecated releases, outdated and duplicate versions, and manifest/lockfile disagreements. A license report is informational. To enforce a policy with `license check`, [configure the licenses you allow](https://docs.githits.com/scan/configuration.md#license-policy) first.

GitHits parses the uploaded files and resolves dependencies. Scan checks upload limits and writes the returned reports. Use the [command reference](https://docs.githits.com/scan/commands.md) for output formats, flags, and exit codes.

## Review what you upload

Upload commands send the **full contents** of selected lockfiles and manifests, with paths relative to the scan root. Package files can contain private package names, registry URLs, and other sensitive values. **Scan does not redact their contents.** Review both `detect` and the selected files before uploading.

The `detect` preview prepares the same files as upload commands, including eligible Cargo and npm workspace member manifests. Scan does not upload source files outside its [supported package files](https://docs.githits.com/scan/configuration.md#supported-package-files), Git history, or `githits-scan.toml`. It has no telemetry or analytics reporting.

You can also work with saved reports without a token or network connection: `audit --from-analysis`, `license report --from-report`, and `license check --sbom`. Reports can reveal dependency names and paths. Review them before sharing.

Read the [Privacy Policy](https://githits.com/privacy) and [Terms of Service](https://githits.com/legal/terms-of-service/) for how GitHits processes submitted data.

## Set up repeatable checks

[Save a reviewed inventory](https://docs.githits.com/scan/configuration.md#save-a-reviewed-inventory) to record which projects you intend to scan. Scan can then stop a CI run when that inventory changes. [The CI guide](https://docs.githits.com/scan/ci.md) shows how to generate an SBOM and check its licenses with a pinned Scan version.

For an integration that submits files and manages analysis jobs directly, use the [HTTP API](https://docs.githits.com/api/lockfile-analysis.md). Its reference covers upload limits, quota rules, and how to interpret results.

If a command fails, use the [troubleshooting guide](https://docs.githits.com/scan/troubleshooting.md) to check its exit code and diagnostic message.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.