Outputs overview

One scan can emit multiple formats. Use the format that matches the consumer.

Format	Flag	Best for
CycloneDX CBOM	`--format cbom`	Machine-readable inventory; CycloneDX-aware tools and GRC ingest
SARIF	`--format sarif`	Security → Code scanning, SARIF viewers, build gates
Markdown	`--format markdown`	Human deliverable for architects and migration owners (default)
JSON	`--format json`	Custom tooling and internal pipelines

cryptarium scan --format cbom --output cbom.json .
cryptarium scan --format sarif --output results.sarif .
cryptarium scan --format markdown --output CRYPTO-REPORT.md .
cryptarium scan --format json --output findings.json .

--format is repeatable when you need several artifacts from one run. See each format page for structure and caveats.