How to run OpenSSF Scorecard on a dependency from the command line

To score a dependency, run the Scorecard CLI with a repository, for example scorecard with the repo flag set to github.com/owner/name, after setting a GitHub token in your environment. Add the show-details flag to see why each check scored as it did. You can also look a package up by ecosystem name.

Set up

You can pull the container image or install the binary. The project notes that the standalone binary needs Go installed, that macOS and Linux are supported, and that Windows may have issues.

Set a GitHub token before you scan. The project accepts GITHUB_AUTH_TOKEN, GITHUB_TOKEN, GH_AUTH_TOKEN or GH_TOKEN. Without one you hit GitHub rate limits quickly.

docker pull ghcr.io/ossf/scorecard:latest
export GITHUB_AUTH_TOKEN=your_token_here

Scan a repository

The basic form takes a repository path.

scorecard --repo=github.com/owner/repo

The output lists each check with a 0 to 10 score and an aggregate at the top. A question mark in the sample output is not defined on the project page, so check a check's detail before reading it as a zero.

Get the reasons, not just the number

The aggregate hides which behaviors are present, so ask for detail.

scorecard --repo=github.com/owner/repo --show-details
scorecard --repo=github.com/owner/repo --checks=Code-Review,Branch-Protection
scorecard --repo=github.com/owner/repo --format=json

Show-details prints the reasons behind each score. The checks flag narrows the run to the ones you care about. JSON output is the right choice if you want to feed results into a script or a review ticket.

Scan by package name

You can pass a package name instead of a repository. The documentation lists npm, PyPI, RubyGems and NuGet.

scorecard --npm=angular

This flag cannot be combined with the repo flag. The tool then scans the project behind that package name. Confirm the repository it matched is the one you expect.

Other hosts

For GitLab, export GITLAB_AUTH_TOKEN and use a gitlab.com repository path. Several checks are not supported there. For GitHub Enterprise Server, set GH_HOST first.

Know the limits

Some Branch-Protection settings need a maintainer token to read, so an outside scan can understate protection. The project also says the checks are heuristics with false positives and false negatives.

Use a Scorecard run as a triage step. If a dependency scores low on checks that matter for your risk, such as Dangerous-Workflow or Token-Permissions, look closer before approving it. Safeguard's dependency scanning covers the known vulnerability side, and a free scan is at gold.safeguard.sh/scan.

Quick check

Sources

• OpenSSF Scorecard repository
• Scorecard project site

Last reviewed: 19 October 2026.