{"slug": "introducing-githits-scan-sboms-audits-and-license-checks-from-your-lockfiles", "title": "Introducing githits-scan: SBOMs, audits, and license checks from your lockfiles", "summary": "GitHits released githits-scan 0.3.0, a command-line tool that finds the lockfiles and manifests in a repository and uses GitHits to generate a software bill of materials, audit dependencies, and report or check licenses. The alpha release, installable via Homebrew, writes SBOMs in CycloneDX 1.7 JSON by default (also SPDX 2.3 tag-value or plain text) and requires a GitHits API token for online analysis; upload commands send the full, unredacted contents of selected lockfiles and manifests. GitHits warns that commands and report formats can change before 1.0 and advises pinning a fixed release version when automating it.", "body_md": "[Back to blog](https://githits.com/blog/)\n\nNovember 6, 2026 · 5 min read\n\n# Introducing githits-scan: SBOMs, audits, and license checks from your lockfiles\n\ngithits-scan finds the lockfiles in your repository and uses GitHits to generate an SBOM, audit dependencies, and report or check licenses.\n\nToday we’re releasing [githits-scan](https://github.com/githits-com/githits-scan) 0.3.0, a command-line tool that turns the lockfiles and manifests in a repository into a software bill of materials (SBOM), a dependency audit, or a license report. It is available through Homebrew.\n\nGitHits already helps coding agents inspect the open-source packages their applications depend on: source code, documentation, security advisories, and related package data. Scan checks a repository’s dependencies. Manifests declare which packages the project needs; lockfiles record the versions selected for installation. Scan finds these files locally and sends the selected files to GitHits, which reads them and identifies the packages and versions. Scan then writes the report on your machine.\n\nScan joins the rest of GitHits. Coding agents access GitHits through MCP, a protocol for connecting agents to tools, or the `githits` command-line tool. They can inspect source code at a selected version or revision, read documentation, and check package data. The `research` tool investigates questions using those sources and returns an explanation with citations. The [Index](https://index.githits.dev) shows which projects are indexed. Scan uses GitHits package data to report on your own repository’s dependencies.\n\nScan is an alpha release. Commands and report formats can still change before 1.0. Use a fixed release version when you automate it, and review the [migration notes](https://github.com/githits-com/githits-scan/releases/tag/v0.3.0) before upgrading.\n\n## Install and preview\n\nOn macOS or Linux with Homebrew installed:\n\n```\nbrew install githits-com/tap/githits-scan\n```\n\nHomebrew installs prebuilt packages where available and otherwise builds from source, including on Intel Macs. Windows users can download a compiled program or install with Cargo, Rust’s package manager. The [installation guide](https://docs.githits.com/scan/installation) covers every option.\n\nOnline analysis needs a GitHits API token. To get one, sign in at [app.githits.com](https://app.githits.com), open the menu in the top-right corner, go to **Account settings**, and create a token under **Personal tokens**. Then export it in your shell:\n\n```\nexport GITHITS_API_TOKEN=\"your-token\"\n```\n\nReplace `your-token` with the token you created.\n\nStart in the repository you want to scan:\n\n```\ngithits-scan detect\n```\n\n`detect` lists the package files Scan would upload. It reads them locally to prepare the selection and needs no token or network connection. On the `githits-scan` repository itself, for example:\n\n```\n1 lockfile in 1 ecosystem, 1 additional manifest included, inventory matches ./githits-scan.toml\n\n  PATH        ECOSYSTEM   BYTES  COMPANION   STATUS\n  Cargo.lock  Rust       49,340  Cargo.toml  included\n```\n\nReview that selection before any online command. Upload commands send the full contents of the selected lockfiles and manifests. Scan does not redact them, and it does not upload source outside those package files. The [overview](https://docs.githits.com/scan/overview) covers privacy, selection, and what stays offline.\n\n## Generate an SBOM\n\nAn SBOM is an inventory of software components in a format other tools can read. Generate one for a release or a compliance request:\n\n```\ngithits-scan sbom generate -o bom.cdx.json\n```\n\nThe default is CycloneDX 1.7 JSON, written to `bom.cdx.json` by the `-o` option above. CycloneDX and SPDX are standard formats for exchanging software inventories; JSON is a structured text format. The same command can write SPDX 2.3 tag-value or a plain text inventory. GitHits processes the uploaded package files and returns the complete document. Scan writes that document and exits. Details and formats are in the [command reference](https://docs.githits.com/scan/commands#generate-an-sbom).\n\n## Audit dependencies\n\nWhen you want to know what is wrong or incomplete in the selected dependency set:\n\n```\ngithits-scan audit\n```\n\nAn audit looks for known vulnerabilities, releases their maintainers no longer recommend, outdated and duplicate versions, and disagreements between manifests and lockfiles. Findings and incomplete checks return exit code 1, a status that tells an automated script the result needs attention. A clean result covers the selected package files; it does not establish that an installed application is safe. When GitHits suggests changes, the report includes them. Scan does not edit your dependencies. See the [audit command](https://docs.githits.com/scan/commands#audit-dependencies) for JSON output and how to inspect a saved analysis offline.\n\n## Report and check licenses\n\nWhen you need to read what licenses appear in the dependency set, without deciding policy yet:\n\n```\ngithits-scan license report\n```\n\nThe report lists license information and identifies where it is missing or incomplete. Exit code 0 means the report was produced, even when some licenses are unknown. It does not mean the dependencies passed your team’s license policy.\n\nTo check against a list of licenses your team allows, save the reviewed file selection with `githits-scan detect --save`, add a `[licenses]` policy to `githits-scan.toml`, then run `githits-scan license check`. The [configuration guide](https://docs.githits.com/scan/configuration#license-policy) shows how to write that policy and check a saved CycloneDX SBOM offline.\n\n## Try it\n\nInstall Scan, run `detect` in a repository you care about, then generate an SBOM, run an audit, or read a license report.\n\n- Repository: [github.com/githits-com/githits-scan](https://github.com/githits-com/githits-scan)\n- Docs: [Scan overview](https://docs.githits.com/scan/overview)\n\nIf something fails, the [troubleshooting guide](https://docs.githits.com/scan/troubleshooting) explains exit codes and error messages. Open an [issue](https://github.com/githits-com/githits-scan/issues) when the docs do not cover it.\n\nWe’d like brutally honest feedback and feature suggestions: what breaks, what confuses you, and what you wish it did. Send them to [support@githits.com](mailto:support@githits.com).", "url": "https://wpnews.pro/news/introducing-githits-scan-sboms-audits-and-license-checks-from-your-lockfiles", "canonical_source": "https://githits.com/blog/introducing-githits-scan/", "published_at": "2026-11-06 00:00:00+00:00", "updated_at": "2026-11-06 13:22:16.178249+00:00", "lang": "en", "topics": ["developer-tools", "ai-tools", "ai-agents", "agent-protocols"], "entities": ["GitHits", "githits-scan", "Homebrew", "CycloneDX", "SPDX", "Cargo", "MCP"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/introducing-githits-scan-sboms-audits-and-license-checks-from-your-lockfiles", "markdown": "https://wpnews.pro/news/introducing-githits-scan-sboms-audits-and-license-checks-from-your-lockfiles.md", "text": "https://wpnews.pro/news/introducing-githits-scan-sboms-audits-and-license-checks-from-your-lockfiles.txt", "jsonld": "https://wpnews.pro/news/introducing-githits-scan-sboms-audits-and-license-checks-from-your-lockfiles.jsonld"}}