OSV-Scanner Output Formats: JSON, SARIF, CycloneDX, and 7 Other Formats

OSV-Scanner supports 10 distinct output formats—ranging from human-readable tables to machine-readable JSON, SARIF, CycloneDX, and SPDX—controlled via the --format (or -f) CLI flag.

The google/osv-scanner repository provides flexible osv-scanner output formats to integrate vulnerability scanning into diverse workflows. Whether you need pretty-printed tables for local debugging or structured SBOM formats for compliance pipelines, the scanner delivers native support for ten distinct serialization options through a single command-line parameter.

Available Output Formats

As defined in [internal/reporter/format.go](https://github.com/google/osv-scanner/blob/main/internal/reporter/format.go), the tool recognizes the following case-sensitive format identifiers:

• Table – Human-readable columnar view optimized for terminal display
• Vertical – One vulnerability per line, ideal for grep and Unix pipelines
• HTML – Web-friendly markup for browser-based reports
• Markdown – GitHub-flavored markdown tables for documentation integration
• JSON – Machine-readable structured data for custom automation
• SARIF – Static Analysis Results Interchange Format (v2.1) for CI integrations
• GH-Annotations – Inline annotations formatted for GitHub Actions logs
• CycloneDX 1.4 – Software Bill of Materials (SBOM) format version 1.4
• CycloneDX 1.5 – Software Bill of Materials (SBOM) format version 1.5
• SPDX 2.3 – Software Package Data Exchange format version 2.3

The canonical enumeration appears in the source code:

var format = []string{"table", "html", "vertical", "json", "markdown", "sarif", "gh-annotations", "cyclonedx-1-4", "cyclonedx-1-5", "spdx-2-3"}

How to Configure the Output Format

Specify your desired osv-scanner output format using the --format flag followed by the lowercase identifier. According to the [docs/output.md](https://github.com/google/osv-scanner/blob/main/docs/output.md), this flag accepts any value from the enumeration above.

The syntax follows this pattern:

osv-scanner scan --format <FORMAT> <PATH>

If omitted, the scanner defaults to the table format for interactive terminal sessions.

Practical Examples for CI/CD and Local Development

Generate JSON for API Integration

Pipe structured results into downstream automation tools:

osv-scanner scan --format json ./my-project > vulnerabilities.json

Export SARIF for GitHub Code Scanning

Upload SARIF v2.1 output directly to GitHub Advanced Security:

osv-scanner scan --format sarif ./my-project > results.sarif

Create CycloneDX Bill of Materials

Generate a compliance-ready SBOM in CycloneDX 1.5 format:

osv-scanner scan --format cyclonedx-1-5 ./my-project > bom.cdx

Emit GitHub Annotations in CI

Surface vulnerabilities directly in GitHub Actions workflow logs:

osv-scanner scan --format gh-annotations ./my-project

Implementation Architecture

The format system is implemented across several key files in the google/osv-scanner repository:

• [internal/reporter/format.go](https://github.com/google/osv-scanner/blob/main/internal/reporter/format.go) – Declares the canonical format string slice that defines valid CLI inputs
• [internal/reporter/sarif_reporter.go](https://github.com/google/osv-scanner/blob/main/internal/reporter/sarif_reporter.go) – Implements the SARIF reporter interface
• [internal/output/sarif.go](https://github.com/google/osv-scanner/blob/main/internal/output/sarif.go) – Generates the SARIF v2.1 JSON structure
• [cmd/osv-scanner/scan/source/command_test.go](https://github.com/google/osv-scanner/blob/main/cmd/osv-scanner/scan/source/command_test.go) – Contains test cases validating --format flag behavior

The architecture cleanly separates format detection (reporter layer) from serialization logic (output layer), allowing new formats to be added without modifying core scanning engine code.

Summary

• OSV-Scanner supports 10 output formats: table, vertical, HTML, Markdown, JSON, SARIF, gh-annotations, CycloneDX 1.4/1.5, and SPDX 2.3
• Use the --format flag to select your serialization method, as defined in internal/reporter/format.go
• SARIF v2.1 enables direct integration with GitHub Advanced Security and other SAST platforms
• CycloneDX and SPDX formats support software supply chain compliance and SBOM generation requirements
• JSON and vertical formats serve automation pipelines and command-line processing workflows

Frequently Asked Questions

What is the default output format when running osv-scanner?

When you omit the --format flag, OSV-Scanner defaults to the table format. This human-readable columnar view is optimized for terminal display and provides immediate visual scanning of vulnerability severity, package names, and affected versions.

Can I generate multiple output formats from a single scan command?

No, the current implementation in google/osv-scanner processes one format per invocation. To generate multiple formats, you must run the scan command separately for each desired output type or pipe the JSON output to a conversion tool. The --format flag accepts only a single value from the enumeration defined in internal/reporter/format.go.

Which format should I use for GitHub Advanced Security integration?

Use SARIF (--format sarif). This produces Static Analysis Results Interchange Format v2.1 output that GitHub Code Scanning can ingest directly. The implementation in internal/output/sarif.go ensures compatibility with GitHub's SARIF upload requirements, allowing vulnerabilities to appear in your repository's Security tab with full metadata and remediation guidance.

How do I generate a Software Bill of Materials (SBOM) with osv-scanner?

Select either CycloneDX 1.4 (--format cyclonedx-1-4), CycloneDX 1.5 (--format cyclonedx-1-5), or SPDX 2.3 (--format spdx-2-3). These machine-readable formats inventory your dependencies and their vulnerabilities, satisfying supply chain security requirements for compliance frameworks and vendor risk assessments.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}