Surveyor
Editions and licenses
The Surveyor comes in four editions. The Surveyor CLI is free, open source and available to everyone: it is the edition most of these docs describe. The other three add surveys of whole artifact repositories and air-gapped operation, and are available by arrangement with Spice Labs.
The editions
| Edition | What it is for | Uploads to Topographer | Air-gapped | Needs a Spice License |
|---|---|---|---|---|
| Surveyor CLI | Survey single artifacts, images and running Java applications, on your machines and in CI | Yes | No | No |
| Surveyor IT | Everything in the Surveyor CLI, plus surveys of whole artifact repositories and cryptographic call-site analysis of Java applications | Yes | No | No |
| Surveyor IT Pro | The surveys of Surveyor IT, with CBOMs and post-quantum readiness rankings produced on premises, nothing leaving your network | No | Yes | Yes |
| Surveyor OT Pro | CBOMs of the cryptographic material (certificates, keys and algorithms) in compiled binaries and device images, from a repository or a file system, fully offline | No | Yes | Yes |
The Surveyor CLI and Surveyor IT upload encrypted survey results to Topographer, which needs a Topographer subscription. Surveyor IT Pro and Surveyor OT Pro never upload and need no Spice Labs account: everything they produce stays on the machine that ran them.
Which commands each edition has
Every edition runs the same spice command; what differs is which subcommands it has. A command an edition lacks is not in its spice --help. The same edition names appear as badges beside each command in the CLI reference.
| Command | Surveyor CLI | Surveyor IT | Surveyor IT Pro | Surveyor OT Pro |
|---|---|---|---|---|
spice survey inventorySurvey files, folders and archives | Yes | Yes | YesAlways runs locally; pass --output to keep the results | No |
spice survey inventory docker://<image>Survey a container image straight from its registry (docker:// or oci://) | Yes | Yes | YesAlways runs locally; pass --output to keep the results | No |
spice survey runtimeRecord the cryptography a running Java application uses | Yes | Yes | YesPrints a summary; nothing is uploaded | No |
spice survey inventory --upload-only, --upload-args, --chunk-sizeUpload inventory survey results to Topographer | Yes | Yes | No | No |
spice survey inventory docker://<image> --upload-args, --chunk-sizeUpload image survey results to Topographer | Yes | Yes | No | No |
spice survey runtime --chunk-sizeUpload runtime survey results to Topographer | Yes | Yes | No | No |
spice registry discover --output, --maxList the packages and versions in an artifact repository or a folder | No | Yes | Yes | Yes |
spice registry cbom --process, --discovery, --output, --threads, --reset, --export-processedBuild a CBOM of every package version a discovery file selects, on this machine | No | Yes | Yes | Yes |
spice registry cbomRank the cryptography in each CBOM for post-quantum readiness, with call sites | No | No | Yes | No |
spice registry runSurvey the versions a discovery file selects and upload the results | No | Yes | No | No |
spice registry statusSummarize what the registry runs have done | No | Yes | Yes | Yes |
spice pass decodeShow what your credential holds | Yes | Yes | Yes | Yes |
spice config explainShow every setting a run would use and where each came from | Yes | Yes | Yes | Yes |
spice docs --commands, --jsonPrint the help for every command, or the commands as JSON | Yes | Yes | YesNeeds a valid Spice License | YesNeeds a valid Spice License |
spice --versionPrint the version and, where a license applies, whether it is valid | Yes | Yes | YesIncludes a license line | YesIncludes a license line |
spice generate-completionPrint the tab completion script (generate-powershell-completion for PowerShell) | Yes | Yes | Yes | Yes |
Surveyor OT Pro has no spice survey: its work is done by registry sweeps, over an artifact repository or a folder of files.
Getting access
The Surveyor CLI is on Docker Hub as spicelabs/spice-labs-cli, and the installer sets it up.
Surveyor IT, IT Pro and OT Pro are not self-serve: contact Spice Labs and we arrange access to the edition’s image, and for IT Pro and OT Pro issue your organization a Spice License. Each edition is one Docker image, run by the same spice wrapper the installer sets up:
| Edition | Image | How the wrapper picks it |
|---|---|---|
| Surveyor IT | ghcr.io/spice-labs-inc/spice-labs-cli-it | --features it |
| Surveyor IT Pro | ghcr.io/spice-labs-inc/spice-labs-cli-itpro | --features itpro |
| Surveyor OT Pro | ghcr.io/spice-labs-inc/spice-labs-cli-otpro | --features otpro |
--features goes before the command, as in spice --features itpro registry discover. On a machine with no network, load the image you were given and point the wrapper at it with SPICE_IMAGE instead: see Air-gapped setup.
Spice Licenses
The air-gapped editions run only with a Spice License: a credential Spice Labs issues to your organization that names the edition and the features it grants. The Surveyor checks it on your machine, offline, so it works without network access.
Set it in the SPICE_LICENSE environment variable before you run spice:
export SPICE_LICENSE="<your Spice License>"$env:SPICE_LICENSE = "<your Spice License>"How to check a license, what happens when it expires and every message a refused run prints are on the Spice License page.
Download the manual
Each edition’s documentation is also one self-contained HTML file that you can keep with the software and read without a network. The Surveyor CLI manual includes the recorded terminal sessions; the others show the same steps as commands.
- Surveyor CLI manual (one HTML file; works offline)
- Surveyor OT Pro manual (one HTML file; works offline)
- Surveyor IT manual (one HTML file; works offline)
- Surveyor IT Pro manual (one HTML file; works offline)