Earnie Reviews & Product Details

Earnie identifies what's really inside your code, whether a developer, an open source package or an AI agent wrote it. Every snippet is matched against the SCANOSS knowledge base, then checked against a policy you set per project, in the UI or as code. Each finding and decision goes into a versioned record. Earnie works through the UI, MCP and CLI. Coding agents ask it what's allowed through MCP, developers run scans and policy checks from the CLI, and operators manage policies, projects and the whole estate in the UI. Every surface uses the same policy and produces the same finding IDs and evidence, and Earnie also checks every commit and pull request through GitHub and GitLab. Four datasets sit under the policy: licence compliance, AI models, cryptography and post-quantum readiness, and security vulnerabilities. Policy decides what's allowed, what warns and what blocks. The record produces SBOMs, AIBOMs and CBOMs in CycloneDX and SPDX, along with notice files and evidence linked to source. Any finding opens into a side-by-side match against the original open source, so it can be defended with the code in front of you. Earnie runs on your server, as SaaS or on-prem, including air-gapped environments.