# OSV-Scanner Output Formats: JSON, SARIF, CycloneDX, and 7 Other Formats

> Explore OSV-Scanner's 10 output formats for scan results, including JSON, SARIF, CycloneDX, and SPDX. Easily generate reports with the --format flag.

- Repository: [Google/osv-scanner](https://github.com/google/osv-scanner)
- Tags: api-reference
- Published: 2026-04-25

---

**OSV-Scanner supports 10 distinct output formats—ranging from human-readable tables to machine-readable JSON, SARIF, CycloneDX, and SPDX—controlled via the `--format` (or `-f`) CLI flag.**

The `google/osv-scanner` repository provides flexible **osv-scanner output formats** to integrate vulnerability scanning into diverse workflows. Whether you need pretty-printed tables for local debugging or structured SBOM formats for compliance pipelines, the scanner delivers native support for ten distinct serialization options through a single command-line parameter.

## Available Output Formats

As defined in [[`internal/reporter/format.go`](https://github.com/google/osv-scanner/blob/main/internal/reporter/format.go)](https://github.com/google/osv-scanner/blob/main/internal/reporter/format.go), the tool recognizes the following case-sensitive format identifiers:

- **Table** – Human-readable columnar view optimized for terminal display
- **Vertical** – One vulnerability per line, ideal for grep and Unix pipelines
- **HTML** – Web-friendly markup for browser-based reports
- **Markdown** – GitHub-flavored markdown tables for documentation integration
- **JSON** – Machine-readable structured data for custom automation
- **SARIF** – Static Analysis Results Interchange Format (v2.1) for CI integrations
- **GH-Annotations** – Inline annotations formatted for GitHub Actions logs
- **CycloneDX 1.4** – Software Bill of Materials (SBOM) format version 1.4
- **CycloneDX 1.5** – Software Bill of Materials (SBOM) format version 1.5
- **SPDX 2.3** – Software Package Data Exchange format version 2.3

The canonical enumeration appears in the source code:

```go
var format = []string{"table", "html", "vertical", "json", "markdown", "sarif", "gh-annotations", "cyclonedx-1-4", "cyclonedx-1-5", "spdx-2-3"}

```

## How to Configure the Output Format

Specify your desired **osv-scanner output format** using the `--format` flag followed by the lowercase identifier. According to the [[`docs/output.md`](https://github.com/google/osv-scanner/blob/main/docs/output.md)](https://github.com/google/osv-scanner/blob/main/docs/output.md), this flag accepts any value from the enumeration above.

The syntax follows this pattern:

```bash
osv-scanner scan --format <FORMAT> <PATH>

```

If omitted, the scanner defaults to the `table` format for interactive terminal sessions.

## Practical Examples for CI/CD and Local Development

### Generate JSON for API Integration

Pipe structured results into downstream automation tools:

```bash
osv-scanner scan --format json ./my-project > vulnerabilities.json

```

### Export SARIF for GitHub Code Scanning

Upload SARIF v2.1 output directly to GitHub Advanced Security:

```bash
osv-scanner scan --format sarif ./my-project > results.sarif

```

### Create CycloneDX Bill of Materials

Generate a compliance-ready SBOM in CycloneDX 1.5 format:

```bash
osv-scanner scan --format cyclonedx-1-5 ./my-project > bom.cdx

```

### Emit GitHub Annotations in CI

Surface vulnerabilities directly in GitHub Actions workflow logs:

```bash
osv-scanner scan --format gh-annotations ./my-project

```

## Implementation Architecture

The format system is implemented across several key files in the `google/osv-scanner` repository:

- **[[`internal/reporter/format.go`](https://github.com/google/osv-scanner/blob/main/internal/reporter/format.go)](https://github.com/google/osv-scanner/blob/main/internal/reporter/format.go)** – Declares the canonical `format` string slice that defines valid CLI inputs
- **[[`internal/reporter/sarif_reporter.go`](https://github.com/google/osv-scanner/blob/main/internal/reporter/sarif_reporter.go)](https://github.com/google/osv-scanner/blob/main/internal/reporter/sarif_reporter.go)** – Implements the SARIF reporter interface
- **[[`internal/output/sarif.go`](https://github.com/google/osv-scanner/blob/main/internal/output/sarif.go)](https://github.com/google/osv-scanner/blob/main/internal/output/sarif.go)** – Generates the SARIF v2.1 JSON structure
- **[[`cmd/osv-scanner/scan/source/command_test.go`](https://github.com/google/osv-scanner/blob/main/cmd/osv-scanner/scan/source/command_test.go)](https://github.com/google/osv-scanner/blob/main/cmd/osv-scanner/scan/source/command_test.go)** – Contains test cases validating `--format` flag behavior

The architecture cleanly separates format detection (reporter layer) from serialization logic (output layer), allowing new formats to be added without modifying core scanning engine code.

## Summary

- **OSV-Scanner supports 10 output formats**: table, vertical, HTML, Markdown, JSON, SARIF, gh-annotations, CycloneDX 1.4/1.5, and SPDX 2.3
- **Use the `--format` flag** to select your serialization method, as defined in [`internal/reporter/format.go`](https://github.com/google/osv-scanner/blob/main/internal/reporter/format.go)
- **SARIF v2.1** enables direct integration with GitHub Advanced Security and other SAST platforms
- **CycloneDX and SPDX** formats support software supply chain compliance and SBOM generation requirements
- **JSON and vertical** formats serve automation pipelines and command-line processing workflows

## Frequently Asked Questions

### What is the default output format when running osv-scanner?

When you omit the `--format` flag, OSV-Scanner defaults to the **table** format. This human-readable columnar view is optimized for terminal display and provides immediate visual scanning of vulnerability severity, package names, and affected versions.

### Can I generate multiple output formats from a single scan command?

No, the current implementation in `google/osv-scanner` processes one format per invocation. To generate multiple formats, you must run the scan command separately for each desired output type or pipe the JSON output to a conversion tool. The `--format` flag accepts only a single value from the enumeration defined in [`internal/reporter/format.go`](https://github.com/google/osv-scanner/blob/main/internal/reporter/format.go).

### Which format should I use for GitHub Advanced Security integration?

Use **SARIF** (`--format sarif`). This produces Static Analysis Results Interchange Format v2.1 output that GitHub Code Scanning can ingest directly. The implementation in [`internal/output/sarif.go`](https://github.com/google/osv-scanner/blob/main/internal/output/sarif.go) ensures compatibility with GitHub's SARIF upload requirements, allowing vulnerabilities to appear in your repository's Security tab with full metadata and remediation guidance.

### How do I generate a Software Bill of Materials (SBOM) with osv-scanner?

Select either **CycloneDX 1.4** (`--format cyclonedx-1-4`), **CycloneDX 1.5** (`--format cyclonedx-1-5`), or **SPDX 2.3** (`--format spdx-2-3`). These machine-readable formats inventory your dependencies and their vulnerabilities, satisfying supply chain security requirements for compliance frameworks and vendor risk assessments.