license-compliance

OpenSCA is an open source software supply chain security solution that supports the detection of open source dependencies, vulnerabilities and license compliance with a widely noticed accuracy by the community.

Security & License Compliance For Your App's Dependencies 🪱

ScanCode.io is a server to script and automate software composition analysis with pipelines. This project is sponsored by the European Commission, NLnet NGI0, the Google Summer of Code, nexB and others generous sponsors!

Repository to hold the new UI framework for FOSSology built with React

GitHub Action for license compliance: Python, JavaScript, iOS, Android and more.

This repo contains license and copyright analysis results of open source packages. It further contains other license compliance relevant artifacts, which might be of value for others

Chrome/Firefox browser extension to compare text against spdx license list

Fast Rust scanner for licenses, copyrights, package metadata, SBOMs, and provenance data.

OSS license watchdog. Monitors GitHub repos you depend on and alerts you when a license changes, explaining exactly what you can no longer do.

🔐⛵ Effortless dependency compliance with your license policies

Dependency management platform for 14 package ecosystems: an LSP server for editor-native hover, completion, and diagnostics; a CLI for automated dependency updates and PRs; and OSV vulnerability, license, and supply-chain scanning. One binary, any editor, any CI.

BomLens — a local-first SBOM generator & open-source risk assessor (CycloneDX). Produce an SBOM, an open-source notice, and a security/license risk report from source code, containers, binaries, firmware, or an SBOM you received. CLI or web UI, no SaaS.

Which license did they mean?

Generate open source software notices (OSS Notice) from SBOM documents — SPDX, CycloneDX, Excel → HTML/Text/Markdown/PDF. Offline, type-safe Python core with CLI, local API, and an installable desktop app.

Free, open-source CLI for dependency intelligence, SBOMs, vulnerability auditing, and CI policy gates.

Educational dependency scanner built in pure Go—parse go.mod and go.sum, inspect direct and indirect modules, query OSV for vulnerabilities, and summarize licenses.

bitbake layer repository for intergrating osselot into the build process

Lucy is a component analysis platform to minimize the risk of license infringements and to support and optimize the license compliance process.

Fast cross-ecosystem dependency license compatibility checker + Claude Code review skill

Toolset that helps you with creating and interacting with SBOMs, enriching with licensing and copyright information, and checking for Open Source license compliance