Introducing githits-scan: SBOMs, audits, and license checks from your lockfiles

GitHits released githits-scan 0.3.0, a command-line tool that finds the lockfiles and manifests in a repository and uses GitHits to generate a software bill of materials, audit dependencies, and report or check licenses. The alpha release, installable via Homebrew, writes SBOMs in CycloneDX 1.7 JSON by default (also SPDX 2.3 tag-value or plain text) and requires a GitHits API token for online analysis; upload commands send the full, unredacted contents of selected lockfiles and manifests. GitHits warns that commands and report formats can change before 1.0 and advises pinning a fixed release version when automating it.

Back to blog https://githits.com/blog/ November 6, 2026 · 5 min read Introducing githits-scan: SBOMs, audits, and license checks from your lockfiles githits-scan finds the lockfiles in your repository and uses GitHits to generate an SBOM, audit dependencies, and report or check licenses. Today we’re releasing githits-scan https://github.com/githits-com/githits-scan 0.3.0, a command-line tool that turns the lockfiles and manifests in a repository into a software bill of materials SBOM , a dependency audit, or a license report. It is available through Homebrew. GitHits already helps coding agents inspect the open-source packages their applications depend on: source code, documentation, security advisories, and related package data. Scan checks a repository’s dependencies. Manifests declare which packages the project needs; lockfiles record the versions selected for installation. Scan finds these files locally and sends the selected files to GitHits, which reads them and identifies the packages and versions. Scan then writes the report on your machine. Scan joins the rest of GitHits. Coding agents access GitHits through MCP, a protocol for connecting agents to tools, or the githits command-line tool. They can inspect source code at a selected version or revision, read documentation, and check package data. The research tool investigates questions using those sources and returns an explanation with citations. The Index https://index.githits.dev shows which projects are indexed. Scan uses GitHits package data to report on your own repository’s dependencies. Scan is an alpha release. Commands and report formats can still change before 1.0. Use a fixed release version when you automate it, and review the migration notes https://github.com/githits-com/githits-scan/releases/tag/v0.3.0 before upgrading. Install and preview On macOS or Linux with Homebrew installed: brew install githits-com/tap/githits-scan Homebrew installs prebuilt packages where available and otherwise builds from source, including on Intel Macs. Windows users can download a compiled program or install with Cargo, Rust’s package manager. The installation guide https://docs.githits.com/scan/installation covers every option. Online analysis needs a GitHits API token. To get one, sign in at app.githits.com https://app.githits.com , open the menu in the top-right corner, go to Account settings , and create a token under Personal tokens . Then export it in your shell: export GITHITS API TOKEN="your-token" Replace your-token with the token you created. Start in the repository you want to scan: githits-scan detect detect lists the package files Scan would upload. It reads them locally to prepare the selection and needs no token or network connection. On the githits-scan repository itself, for example: 1 lockfile in 1 ecosystem, 1 additional manifest included, inventory matches ./githits-scan.toml PATH ECOSYSTEM BYTES COMPANION STATUS Cargo.lock Rust 49,340 Cargo.toml included Review that selection before any online command. Upload commands send the full contents of the selected lockfiles and manifests. Scan does not redact them, and it does not upload source outside those package files. The overview https://docs.githits.com/scan/overview covers privacy, selection, and what stays offline. Generate an SBOM An SBOM is an inventory of software components in a format other tools can read. Generate one for a release or a compliance request: githits-scan sbom generate -o bom.cdx.json The default is CycloneDX 1.7 JSON, written to bom.cdx.json by the -o option above. CycloneDX and SPDX are standard formats for exchanging software inventories; JSON is a structured text format. The same command can write SPDX 2.3 tag-value or a plain text inventory. GitHits processes the uploaded package files and returns the complete document. Scan writes that document and exits. Details and formats are in the command reference https://docs.githits.com/scan/commands generate-an-sbom . Audit dependencies When you want to know what is wrong or incomplete in the selected dependency set: githits-scan audit An audit looks for known vulnerabilities, releases their maintainers no longer recommend, outdated and duplicate versions, and disagreements between manifests and lockfiles. Findings and incomplete checks return exit code 1, a status that tells an automated script the result needs attention. A clean result covers the selected package files; it does not establish that an installed application is safe. When GitHits suggests changes, the report includes them. Scan does not edit your dependencies. See the audit command https://docs.githits.com/scan/commands audit-dependencies for JSON output and how to inspect a saved analysis offline. Report and check licenses When you need to read what licenses appear in the dependency set, without deciding policy yet: githits-scan license report The report lists license information and identifies where it is missing or incomplete. Exit code 0 means the report was produced, even when some licenses are unknown. It does not mean the dependencies passed your team’s license policy. To check against a list of licenses your team allows, save the reviewed file selection with githits-scan detect --save , add a licenses policy to githits-scan.toml , then run githits-scan license check . The configuration guide https://docs.githits.com/scan/configuration license-policy shows how to write that policy and check a saved CycloneDX SBOM offline. Try it Install Scan, run detect in a repository you care about, then generate an SBOM, run an audit, or read a license report. - Repository: github.com/githits-com/githits-scan https://github.com/githits-com/githits-scan - Docs: Scan overview https://docs.githits.com/scan/overview If something fails, the troubleshooting guide https://docs.githits.com/scan/troubleshooting explains exit codes and error messages. Open an issue https://github.com/githits-com/githits-scan/issues when the docs do not cover it. We’d like brutally honest feedback and feature suggestions: what breaks, what confuses you, and what you wish it did. Send them to support@githits.com mailto:support@githits.com .