Live webinarWebinar with Jason Lee, Tue, Oct 13Your newest insider is an AI agent.Jason LeeFormer CISO, Zoom & SplunkRegister

Open-source licenses, sorted before legal asks.

Every license in your dependencies classified, and your legal policy applied to each.

Try the cloudBook a demo
checkout-apiLicense complianceDemo project
  • Blockeditext7-core 8.0.5pom.xml

    Read in pom.xml as AGPL-3.0-only, a strong copyleft.

    <name>GNU Affero General Public License v3</name>

    Strong copyleft: blocked by default, transitive included.

Your policy, applied to every package.

  • Four families

    • MIT
    • LGPL-2.1
    • GPL-3.0
    • AGPL-3.0

  • SPDX expressions

    • MIT OR GPL-3.0
    • Apache-2.0 AND BSD-3-Clause

  • Your overrides

    • LGPL-2.1 → permissive

  • Ignored packages

    • @acme/internal-*
    • test/fixtures/**

Your policy decides what is flagged.

Every package flagged

  • Alert: itext7-core 8.0.5
  • Alert: jszip 3.10.1
  • Alert: hibernate-core 6.6.1.Final
  • Alert: @acme/billing-utils 1.2.0

Your policy applied

  • Blocked: itext7-core 8.0.5pom.xml
  • Allowed: jszip 3.10.1OR keeps the least restrictive option.
  • Allowed: hibernate-core 6.6.1.FinalYour org override: LGPL-2.1 counts as permissive.
  • Unknown: @acme/billing-utils 1.2.0No license declared: assign the SPDX identifier by hand.

No extra job to run.

Read from the SCA scan's manifests, next to your vulnerability findings.

  1. SCA scanManifests read on every push.Read
  2. SPDXEach license sorted into four families.Classified
  3. Your policyYour overrides and blocks applied.Blocked
  4. ReportUnknown licenses first, filtered per team.Ready

Start with one repository.

Connect GitHub, GitLab, Bitbucket or Azure DevOps, pick a repository, and the first scan starts.

Try the cloudBook a demo

In detail

Every license in the tree, classified.

License extraction reuses the manifest parse of the SCA scan, and the results sit next to the vulnerability findings.

  • Four families

    More than 100 licenses classified in advance, transitive dependencies included.

  • SPDX expressions

    OR keeps the least restrictive option, AND the strictest, WITH applies the exception.

  • Your overrides

    Treat LGPL-2.1 as permissive once, and every project follows.

  • Custom licenses

    In-house or vendor licenses, tracked next to the open-source ones.

  • Ignored packages

    Internal modules, test fixtures and dev-only tooling, set aside.

  • Every ecosystem

    npm, Yarn, pnpm, Bun, Deno, pip, Poetry, Pipenv, Maven, Gradle, Go modules, NuGet, Composer, Cargo, CocoaPods, Swift PM, Pub, Hex, RubyGems, Conan, Clojars and GitHub Actions.

Everything it checks

Four families, your rules on top.

Every SPDX identifier maps to a family your legal team owns. Expressions are resolved, overrides are yours.

  • Permissive

    Use, modify, ship. Keep the notice, nothing else is owed.

    Allowed

  • Weak copyleft

    Changes to the library go back. Your own code stays yours.

    Review

  • Strong copyleft

    Linking it means opening your product. Blocked by default, transitive included.

    Blocked

  • Unknown

    No SPDX in the metadata, a custom text, a broken field. Somebody has to read it.

    Ask

  • SPDX expressions, resolved

    OR picks the least restrictive option, AND keeps the strictest, WITH applies the exception.

  • Your override

    Legal cleared LGPL-2.1 for the whole org? Set it once, every project follows.

Six features, one legal-ready report.

SPDX extraction, expression-aware risk, org overrides and per-package ignore.

  • Automatic SPDX extraction on every SCA scan

    Licenses are pulled from package metadata at scan time. No extra job to schedule, no separate tool to install.

  • Four risk categories, 100+ licenses pre-classified

    Permissive (MIT, Apache-2.0, BSD-2-Clause, ISC), Weak Copyleft (LGPL-2.1, MPL-2.0, EPL-2.0), Strong Copyleft (GPL-3.0, AGPL-3.0, SSPL-1.0), or Unknown when the manifest is silent.

  • SPDX expression parser. OR, AND, WITH

    MIT OR GPL-3.0-only resolves to the least restrictive option (Permissive).

  • Organisation-level overrides

    If your legal team treats LGPL-2.1 as Permissive, override it once at the organisation level and every project inherits the new classification immediately.

  • Manual assignment for Unknown licenses

    When the manifest doesn't declare a license, the package lands in the Unknown bucket.

  • Ignore internal or test-only packages

    Toggle the ignore flag on any package. Internal monorepo modules, test fixtures, dev-only tooling.

Risk you can defend in front of legal.

  • Aligned with your legal posture

    Every SPDX identifier maps to a category your team owns. Override defaults, add custom proprietary licenses, reset whenever policy changes.

  • No extra job to run

    License extraction shares the manifest parse step that the SCA scan already performs.

  • Filterable for every audience

    Engineering filters by branch and ecosystem to focus on what they own.

From flag to policy

  • GPL-3.0 in the tree.

    A strong copyleft pulled in transitively.

  • Judged by policy.

    SPDX resolved, your overrides applied.

  • Cleared or replaced.

    Owner assigned, legal approved, report filed.

What teams ask before turning it on.

How is the risk level for each license decided?
Every SPDX identifier maps to one of four categories. Permissive, Weak Copyleft, Strong Copyleft or Unknown. Based on a built-in classification covering 100+ licenses. Organisations can override any classification to match their legal policy; overrides apply immediately to every project in the org.
What happens when a package has no detected license?
The package lands in the Unknown bucket. From the license summary you can open the package and assign the correct SPDX identifier manually; the package then re-categorises and feeds the right counters in the summary. Unknown licenses are surfaced first in the dashboard so they don't quietly accumulate.
Does license detection slow the SCA scan?
No. License extraction reuses the manifest parse step the SCA scan already performs. There's no separate job, no second pipeline, no incremental scan window. License data appears in the same dashboard alongside vulnerability findings.
Can we add custom proprietary licenses?
Yes. The organisation-level configuration accepts custom entries with a chosen classification (Permissive, Weak Copyleft, Strong Copyleft or Unknown). Useful for in-house licenses or vendor agreements that aren't part of SPDX but still need to be tracked alongside open-source licenses.
How are complex SPDX expressions evaluated?
OR picks the least restrictive option (`MIT OR GPL-3.0-only` → effective risk None). AND picks the most restrictive option (`MIT AND GPL-3.0-only` → effective risk High). WITH evaluates the base license with the exception applied (`GPL-2.0-only WITH Classpath-exception-2.0` → GPL-2.0 with Classpath exception). The dashboard shows both the raw expression and the resolved category.