Open Source License Compliance Checker

Private SPDX policy review

Review dependency licenses, SPDX expressions, policy decisions and attribution gaps locally.

cyclonedx SPDX Expression Denied component present

Components

License IDs

Allowed

Needs review

Denied

Missing evidence

Dependency evidence stays local

The page does not execute package scripts, query a registry or upload lockfiles and SBOMs.

Dependency, SBOM or CSV evidence

Supports package.json, package-lock, pnpm-lock, Yarn lock, CycloneDX JSON, SPDX 2.x JSON and a named CSV.

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "version": 1,
  "components": [
    {
      "type": "library",
      "name": "ui-kit",
      "version": "4.2.0",
      "purl": "pkg:npm/@example/ui-kit@4.2.0",
      "author": "Example UI Contributors",
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "type": "library",
      "name": "http-client",
      "version": "3.1.0",
      "purl": "pkg:npm/http-client@3.1.0",
      "licenses": [
        {
          "expression": "Apache-2.0 OR MIT"
        }
      ]
    },
    {
      "type": "library",
      "name": "document-engine",
      "version": "2.0.0",
      "purl": "pkg:npm/document-engine@2.0.0",
      "licenses": [
        {
          "license": {
            "id": "MPL-2.0"
          }
        }
      ]
    },
    {
      "type": "library",
      "name": "network-service",
      "version": "1.8.0",
      "purl": "pkg:npm/network-service@1.8.0",
      "licenses": [
        {
          "license": {
            "id": "AGPL-3.0-only"
          }
        }
      ]
    },
    {
      "type": "library",
      "name": "legacy-parser",
      "version": "0.9.1",
      "purl": "pkg:npm/legacy-parser@0.9.1"
    }
  ]
}

How to use it

01
Load dependency evidence
Open a supported lockfile, dependency manifest, SPDX or CycloneDX SBOM, or CSV inventory.
02
Evaluate license policy
Review expressions, categories, obligations, unknown evidence and editable allow-review-deny rules.
03
Prepare reviewed artifacts
Compare a baseline and export reports, policy, CI results or a third-party attribution index.

Frequently asked questions

Does this scan source code or binaries?

No. It analyzes the dependency and license evidence you provide without executing package scripts.

Is this legal advice?

No. Categories and obligations are engineering triage; counsel must interpret the actual licenses and product context.

Why do lockfiles show unknown licenses?

Many lockfiles do not contain license metadata. The tool reports that gap instead of silently querying a registry or guessing.

Is the generated attribution file complete?

It is a review index and explicitly lists missing full license texts and notices that still need to be supplied.

Keep working with other focused browser utilities.

All tools

How to use it

Load dependency evidence

Evaluate license policy

Prepare reviewed artifacts

Frequently asked questions

Related tools

SBOM Supply Chain Explorer

Package & Dependency Risk Inspector

Git Repository & Patch Reviewer