DEDUPED Hot AI repos. Real use cases. What people build. Get the Monday 5

How to scan a container image and check licenses with Osv Scanner

Scan an image layer by layer, then check dependency licenses against an allow list.

Short answer: Install OSV-Scanner from the releases page; then run osv-scanner scan image my-image-name:tag with your image; run osv-scanner --licenses path/to/repository for a license summary. All steps.

data. License scanning sends package names, versions and ecosystems to deps.dev.

Who it is forA platform team gating images and dependencies before they reach production.

The problemBase images and licenses both carry hidden risk.

The outcomeImage vulnerabilities plus a license report for a project.

What you need first

  • A prebuilt binary from the releases page, or Go to run go install
  • A project directory with lockfiles or manifests, or a container image
  • Network access to OSV.dev, unless you use offline mode

Steps

  1. Install OSV-Scanner from the releases page
  2. Run osv-scanner scan image my-image-name:tag with your image
  3. Run osv-scanner --licenses path/to/repository for a license summary
  4. Run osv-scanner --licenses="MIT,Apache-2.0" path/to/directory to check against an allowed SPDX list

Prompt for your agent

With google/osv-scanner, run `osv-scanner scan image my-image-name:tag` for <my image>, then `osv-scanner --licenses path/to/repository` for <my repo>, and list anything that breaks an allowed list of MIT and Apache-2.0.

Caveat. Image scanning covers Alpine, Debian and Ubuntu plus Go, Java, Node and Python artifacts.

Use this in your AI agent

Ask your agent

Using the Deduped MCP, get the setup steps for google/osv-scanner and "Scan a container image and check licenses"

Add Deduped to Claude Code once

claude mcp add --transport http deduped https://dedupedai.com/mcp

Cursor, ChatGPT, others

Share: X LinkedIn Hacker News Email Copy link

Third-party repos we don't own. AI-written use cases can be wrong. Disclaimer