Dependency License Audit#

Scan project dependencies for license compatibility issues across multiple ecosystems.

Quick Start#

bash

# Basic scan (permissive policy)
python3 scripts/license_audit.py /path/to/project

# Strict enterprise scan with CI exit codes
python3 scripts/license_audit.py /path/to/project --policy permissive --ci --format markdown

# Allow weak copyleft (LGPL, MPL)
python3 scripts/license_audit.py /path/to/project --policy weak-copyleft

# Include transitive deps (npm)
python3 scripts/license_audit.py /path/to/project --include-transitive

# JSON output for tooling
python3 scripts/license_audit.py /path/to/project --format json

Supported Ecosystems#

EcosystemFiles ParsedLicense Sourcenpmpackage.json, package-lock.json, node_modules/*/package.jsonPackage metadatapiprequirements.txt, Pipfile, pyproject.tomlInstalled package metadataGogo.modManual/UNKNOWN (no local metadata)RustCargo.tomlManual/UNKNOWN (no local metadata)RubyGemfileManual/UNKNOWN (no local metadata)

npm and pip auto-detect licenses from installed packages. Go/Rust/Ruby report UNKNOWN unless packages are installed — review manually.

Policies#

PolicyAllowsUse Whenpermissive (default)MIT, Apache-2.0, BSD, ISC, etc.Proprietary/commercial projectsweak-copyleft+ LGPL, MPL, EPLLibrary consumers (dynamic linking)any-openAll OSI-approvedOpen-source projectscustomUser-definedEnterprise with specific requirements

For custom policy setup, see references/custom-policy.md.

Output Formats#

• text — Human-readable terminal output (default)
• json — Machine-readable for CI pipelines and tooling
• markdown — Report with tables, suitable for PRs or documentation

CI Exit Codes#

With --ci flag:

• 0 — No issues
• 1 — Warnings only (unknown licenses)
• 2 — Policy violations found

License Classifications#

The scanner classifies licenses into categories:

• permissive — MIT, Apache-2.0, BSD, ISC, Unlicense, CC0, etc.
• weak-copyleft — LGPL, MPL, EPL, CDDL (modifications must be shared, but linking is OK)
• strong-copyleft — GPL, AGPL, SSPL (derivative works inherit the license)
• proprietary — UNLICENSED or commercial indicators
• unknown — Not recognized; manual review needed

SPDX expressions ( MIT OR Apache-2.0, MIT AND BSD-3-Clause) are evaluated: OR picks most permissive, AND picks most restrictive.

Workflow#

1. Run audit against project directory
2. Review violations and warnings in output
3. For each violation, follow the recommendations provided
4. Optionally create .license-policy.json for custom rules
5. Add --ci flag to CI pipeline for automated enforcement