Get started
How Spice Labs works
Spice Labs builds an inventory of the cryptography in everything you ship, then tells you what needs to change for post-quantum migration and which fixes to make first. It works from built software (jars, wars, ears, container images, VM and device images), so it needs no source code, no agents in your applications and no changes to your builds.
The Surveyor and Topographer
The Surveyor is a command you run on your machines and in your CI. It is not an agent: it runs only when you run it, adds nothing to your applications, and leaves nothing running after a survey finishes. It reads every file in what you survey and computes a cryptographic fingerprint of each one.
The Surveyor CLI is free and open source; three further editions survey whole artifact repositories and work in air-gapped sites.
The one exception is a runtime survey: it attaches a recorder to the single Java process you start under it, for as long as that process runs.
Topographer is the hosted service, used through the dashboard at dashboard.spicelabs.io, the REST API and AI assistants. It matches the fingerprints against a large graph of known open-source software and cryptographic libraries and builds the results:
- a component inventory, including copies of open source that appear in no manifest because they were vendored, renamed or bundled into other files;
- a cryptography inventory: the algorithms, keys and certificates found, each classified for post-quantum readiness, delivered as CycloneDX CBOMs;
- vulnerability findings for the components that are really present;
- a Portfolio that scores every application and ranks the fixes that improve the most applications at once.
What leaves your machine
A survey runs where your software is. The Surveyor builds an encrypted model of what it found and uploads only that model, using a Spice Pass that can upload to one project and do nothing else. Your files and source code never leave your machine.
The air-gapped editions upload nothing at all.Three kinds of survey
| Survey | Answers | Guide |
|---|---|---|
| Inventory | What cryptography and which components are present in this build? | Inventory surveys |
| Image | The same question, for a container image pulled by name | Image surveys |
| Runtime | Which cryptography does this Java application actually use when it runs? | Runtime surveys |
An inventory survey and a runtime survey of the same artifact combine into one CBOM that separates cryptography that is merely present from cryptography confirmed to run.
Reports and history
Each survey is kept. When Spice Labs’ knowledge of software and cryptography improves, existing reports are marked stale and can be regenerated from the stored survey, so you get better answers without surveying again. Surveying the same application over time shows findings going away as fixes land.