A cryptographic inventory for your codebase

3329lens walks a codebase, finds the cryptography it depends on, resolves real versions from lockfiles, correlates them against an offline advisory database, and exports the result as a CycloneDX CBOM or a SARIF log.

cargo install --locked lens3329      # installs the `3329lens` binary
3329lens scan --path ./my-project

Open source under the Apache License 2.0. Everything runs offline: the scanner makes no network requests.

Two questions it answers

What cryptography is actually in here? Including crypto pulled in transitively, with the versions your lockfiles really resolve to.
Which of it breaks when a cryptographically relevant quantum computer arrives? Each finding is flagged for quantum risk, and the interactive dashboard builds a prioritised post-quantum migration plan.

What it does

Detects binary artefacts (.so, .dll, .dylib, .a) and declared dependencies in Cargo.toml, package.json, requirements.txt, pyproject.toml and Pipfile.
Resolves versions from Cargo.lock, package-lock.json, npm-shrinkwrap.json, poetry.lock and Pipfile.lock.
Correlates lockfile-resolved versions against a local RustSec advisory-db clone or an OSV export, with ecosystem-aware version comparison (semver for Cargo and npm, PEP 440 for PyPI).
Exports text, JSON, CycloneDX 1.6 CBOM and SARIF 2.1.0.
Shows it live in a terminal dashboard with scan, category, statistics and migration views.

Gate your CI on it

git clone --depth 1 https://github.com/rustsec/advisory-db
3329lens scan --path . --advisory-db ./advisory-db --fail-on high

Exit code	Meaning
`0`	Success: no finding met the `--fail-on` threshold
`1`	Operational error (bad path, unreadable database, write failure)
`2`	A vulnerability at or above the threshold was found

An advisory database that yields no usable advisories is a hard error, not an empty result. "Nothing matched" because nothing loaded would look exactly like a clean bill of health, and would let the CI gate pass for the wrong reason.

For GitHub code scanning, write --format sarif and upload the result with github/codeql-action/upload-sarif. Severity is mapped so GitHub buckets findings correctly.

Scope and limitations

Algorithm assets in the CBOM are inferred from library identity, not observed at runtime: they mean "this library can do X", not "X is invoked". Versions and transitive dependencies are evidence-based, from lockfiles.
Only lockfile-resolved versions are correlated. Declared ranges such as ^1.2 are skipped rather than guessed.
Advisory coverage is limited to the database you supply and to the Cargo, npm and PyPI ecosystems. Run it alongside cargo audit, npm audit or pip-audit, not instead of them.
Quantum-risk flags are a property of the algorithm, not of how you use it.

Why 3329?

3329 is the modulus q of ML-KEM (Kyber), the post-quantum key encapsulation mechanism standardised by NIST in FIPS 203.

3329lens or lens3329?

The product, the command, the domain and the GitHub organisation are all 3329lens. The Rust crate is published as lens3329 because Cargo rejects package names that start with a digit. Install lens3329 to get the 3329lens command, or depend on it with default-features = false to embed the scanning core in your own program.

Documentation

The README is the reference: per-platform install steps, every output format, the dashboard's keys and the library API. API documentation is on docs.rs, and release history is in the changelog.