allowed
Permissive
Use, modify, ship. Keep the notice, nothing else is owed.
MITApache-2.0BSD-3-ClauseISC0BSD
Open-source licenses, before legal.
Every dependency, direct and transitive, classified and overridable to match your legal posture.
pipansible-core@2.17.5GPL-3.0-or-latercheckingblocked
npmsharp@0.33.5Apache-2.0checkingallowed
mavenhibernate-core@6.6.1LGPL-2.1-onlycheckingreview
pipnumpy@2.1.2BSD-3-Clausecheckingallowed
mavenitext7-core@8.0.5AGPL-3.0-onlycheckingblocked
npmexpress@4.21.2MITcheckingallowed
Since the scan started
- 3allowed
- 1review
- 2blocked
- 0ask
Four families,
your rules on top.
Every SPDX identifier maps to a family your legal team owns. Expressions are resolved, overrides are yours.
review
Weak copyleft
Changes to the library go back. Your own code stays yours.
LGPL-2.1MPL-2.0EPL-2.0blocked
Strong copyleft
Linking it means opening your product. Blocked by default, transitive included.
GPL-2.0GPL-3.0AGPL-3.0ask
Unknown
No SPDX in the metadata, a custom text, a broken field. Somebody has to read it.
no SPDXSEE LICENSE INcustomSPDX
SPDX expressions, resolved
OR picks the least restrictive option, AND keeps the strictest, WITH applies the exception.
MIT OR GPL-3.0-only(Apache-2.0 AND MIT)GPL-2.0-only WITH Classpath-exception-2.0override
Your override
Legal cleared LGPL-2.1 for the whole org? Set it once, every project follows.
LGPL-2.1 → permissiveorg-wideWhat shipsEvery verdict
Every verdict
comes with its rule.
SPDX extraction, expression-aware risk, org overrides and per-package ignore.
npm
express4.21.2package.json
"license": "MIT"MITpermissiveallowed
Read from package.json during the SCA scan: MIT is permissive.
Why platform teams pick CybeDefend for license complianceRisk you can
Risk you can
defend in front of legal.
No extra job to run
License extraction shares the manifest parse step that the SCA scan already performs.
SCA scanmanifest parsevulnerabilitieslicenses
Aligned with your legal posture
Every SPDX identifier maps to a category your team owns. Override defaults, add custom proprietary licenses, reset whenever policy changes.
MPL-2.0weak copyleftdefaultLicenseRef-acme-eulapermissivecustomEPL-2.0permissiveoverrideFilterable for every audience
Engineering filters by branch and ecosystem to focus on what they own.
express4.21.2MITallowedaxe-core4.10.0MPL-2.0reviewffmpeg-static5.2.0GPL-3.0-or-laterblockedLicense compliance · 14 ecosystemsFrom npm to NuGet,
From npm to NuGet,
Hex to Conan.
License extraction runs on every SCA scan, in each of these ecosystems.
npm · Yarn · pnpm · Bun · Deno
package.json"express": "^4.21.2"express4.21.2MITallowedPoint at an ecosystem to see a real dependency and its license.Tap an ecosystem to see a real dependency and its license.
How it works,
in detail.
The documentation walks you through setup, configuration and every option.
Read the docsPlatform Overview / Key Features
License Compliance
License categories, SPDX expressions, manual overrides, organization-wide classifications and supported ecosystems.
License Compliance · FAQ
What teams ask before turning it on.
How is the risk level for each license decided?
Every SPDX identifier maps to one of four categories. Permissive, Weak Copyleft, Strong Copyleft or Unknown. Based on a built-in classification covering 100+ licenses. Organisations can override any classification to match their legal policy; overrides apply immediately to every project in the org.
What happens when a package has no detected license?
The package lands in the Unknown bucket. From the license summary you can open the package and assign the correct SPDX identifier manually; the package then re-categorises and feeds the right counters in the summary. Unknown licenses are surfaced first in the dashboard so they don't quietly accumulate.
Does license detection slow the SCA scan?
No. License extraction reuses the manifest parse step the SCA scan already performs. There's no separate job, no second pipeline, no incremental scan window. License data appears in the same dashboard alongside vulnerability findings.
Can we add custom proprietary licenses?
Yes. The organisation-level configuration accepts custom entries with a chosen classification (Permissive, Weak Copyleft, Strong Copyleft or Unknown). Useful for in-house licenses or vendor agreements that aren't part of SPDX but still need to be tracked alongside open-source licenses.
How are complex SPDX expressions evaluated?
OR picks the least restrictive option (`MIT OR GPL-3.0-only` → effective risk None). AND picks the most restrictive option (`MIT AND GPL-3.0-only` → effective risk High). WITH evaluates the base license with the exception applied (`GPL-2.0-only WITH Classpath-exception-2.0` → GPL-2.0 with Classpath exception). The dashboard shows both the raw expression and the resolved category.
Install VibeDefend in 5 seconds.
One command wires every coding agent on your machine to CybeDefend: your business rules, your compliance frameworks, and guards that block destructive calls before they fire.
Install in 5 secondsNode 18.17+
npx -y @cybedefend/vibedefend@latest installAuto-detects
Claude Code
Cursor
OpenAI Codex
Windsurf
VS Code Copilot