CLI vs Quick Import
Choose between Quick Import and the FOSSA CLI based on your build environment and accuracy needs.
Overview
When you first integrate with FOSSA, start with Quick Import, the fastest way to import projects and get a feel for the dependencies and licenses in your code. Depending on your build, you may then want the CLI for deeper accuracy. Two differences drive that choice.
Static vs dynamic analysis
- Static analysis parses the files in your project to infer dependencies and their relationships. Quick Import (and the Broker) use static analysis only.
- Dynamic analysis uses your actual build tools (e.g. the Maven or Gradle CLIs) to learn exactly what's included. The CLI supports both static and dynamic analysis, which makes it more accurate for complex builds. (See the CLI's analysis strategies.)
Custom license scans and keyword matches
Custom License Scans and keyword matches let you define strings that FOSSA treats as a license. These are supported only with provided builds: that is, the CLI.
At a glance
| Quick Import | FOSSA CLI | |
|---|---|---|
| Setup speed | Fastest: connect and go | Requires a working build |
| Analysis | Static only | Static and dynamic |
| Accuracy on complex builds | Good | Best |
| Code access for FOSSA | FOSSA pulls your code | None; uploads signatures only |
| Custom license / keyword scans | No | ✅ |
| Ignore paths / dependency types | Limited | Fine-grained control |
| Best for | Broad coverage across many repos | Accuracy on specific projects, CI |
Recommendation
Use Quick Import for speed and breadth, especially when onboarding many repositories at once. Switch to the CLI for any project where you need the full range of analysis strategies, custom features, or want to avoid granting code access. Many teams use both: Quick Import for coverage, the CLI where accuracy matters most.
What's next
- Quick Import: Get started with the fastest setup method to import and analyze your repositories.
- CI/CD Scanning: Set up the FOSSA CLI in your pipeline for deeper dependency analysis.
- Supported Languages: Check which languages and package managers are supported before choosing a scanning method.