Spice Labs documentation

Spice Labs finds the cryptography inside the software you ship, tells you how ready it is for post-quantum migration, and ranks the fixes that matter most. The Surveyor surveys your built applications on your own machines; Topographer, the hosted service, turns those surveys into a portfolio, reports and CBOMs.

Start here

Quick start Survey your first application and see its results in about ten minutes. How Spice Labs works The Surveyor, Topographer, and what happens to your data in between. Install the Surveyor CLI One command on macOS, Linux or Windows. Watch the 2-minute overview See a survey become a portfolio, reports and a plan, in short videos.

Survey your software

Inventory surveys Survey jars, wars, ears and build folders. Image surveys Survey a container image straight from its registry. Runtime surveys Record the cryptography a Java application really uses. GitHub Actions Survey every build automatically. Editions and licenses Surveyor IT, IT Pro and OT Pro, for surveys at scale and air-gapped sites. CLI reference Every command and option.

Read the results

The Portfolio Scores, what to fix next, and simulating a fix before you make it. Post-quantum readiness reports Which algorithms you use and how urgently each must change. CBOMs CycloneDX cryptography bills of materials, per survey and combined.

API and administration

REST API Everything the dashboard shows, from your scripts and CI. Connect an AI assistant Let Claude Code, ChatGPT or another assistant work with your projects. Administration Organizations, projects, teams, roles and users.

Get help

Email support@spicelabs.io, or ask in the Spice Labs Matrix community room. For a problem with a survey, include the output of the run with --log-level debug, with your Spice Pass removed.