Quickstart

Get from zero to a prioritized crypto inventory in a few minutes.

1. Install

# Go 1.26+
go install github.com/sgoveia/cryptarium/cmd/cryptarium@v0.3.0

Pre-built binaries are attached to GitHub Releases. See Install for all options. Remote HTTPS scans also need git on your PATH.

2. Scan

# Local checkout
cryptarium scan .

# Public HTTPS git repository
cryptarium scan https://github.com/OWNER/REPO

3. Emit the formats you need

# Human-readable migration report
cryptarium scan --format markdown --output CRYPTO-REPORT.md .

# CycloneDX CBOM
cryptarium scan --format cbom --output cbom.json .

# SARIF for GitHub code scanning
cryptarium scan --format sarif --output results.sarif .

- uses: sgoveia/cryptarium@v0.3.0
  with:
    path: .
    fail-on: critical
    upload-sarif: true

Example report

# cryptarium report

Tool: cryptarium 0.0.0-dev

Findings: **4** · 2 critical · 2 high · 0 medium · 0 low

| Priority | Class | Location | Primitive | Recommendation |
|---|---|---|---|---|
| critical (83) | broken | `certs/ecdsa-p256.pem` | ECDSA | ML-DSA-65 (FIPS 204) |
| critical (83) | broken | `certs/rsa2048.pem` | RSA | ML-KEM-768 / ML-DSA-65 (FIPS 203 / FIPS 204) |
| high (70) | broken | `go.mod:6` | RSA | ML-KEM-768 / ML-DSA-65 (FIPS 203 / FIPS 204) |
| high (78) | broken | `token.go:9` | RSA | ML-KEM-768 / ML-DSA-65 (FIPS 203 / FIPS 204) |

Findings are plain and specific: location, classification, recommended target, and priority. See Reading the migration report.

Next steps

Concepts

How evidence sources, classification, and scoring work.

CI/CD & workflows

Wire cryptarium into CI, GitOps, and agentic triage loops.