Dependency License Audit

Scan project dependencies for license compatibility issues across multiple ecosystems.

Quick Start

# Basic scan (permissive policy)
python3 scripts/license_audit.py /path/to/project

# Strict enterprise scan with CI exit codes
python3 scripts/license_audit.py /path/to/project --policy permissive --ci --format markdown

# Allow weak copyleft (LGPL, MPL)
python3 scripts/license_audit.py /path/to/project --policy weak-copyleft

# Include transitive deps (npm)
python3 scripts/license_audit.py /path/to/project --include-transitive

# JSON output for tooling
python3 scripts/license_audit.py /path/to/project --format json

Supported Ecosystems

npm and pip auto-detect licenses from installed packages. Go/Rust/Ruby report UNKNOWN unless packages are installed — review manually.

Policies

For custom policy setup, see references/custom-policy.md.

Output Formats

• text — Human-readable terminal output (default)
• json — Machine-readable for CI pipelines and tooling
• markdown — Report with tables, suitable for PRs or documentation

CI Exit Codes

With --ci flag:

• 0 — No issues
• 1 — Warnings only (unknown licenses)
• 2 — Policy violations found

License Classifications

The scanner classifies licenses into categories:

• permissive — MIT, Apache-2.0, BSD, ISC, Unlicense, CC0, etc.
• weak-copyleft — LGPL, MPL, EPL, CDDL (modifications must be shared, but linking is OK)
• strong-copyleft — GPL, AGPL, SSPL (derivative works inherit the license)
• proprietary — UNLICENSED or commercial indicators
• unknown — Not recognized; manual review needed

SPDX expressions (MIT OR Apache-2.0, MIT AND BSD-3-Clause) are evaluated: OR picks most permissive, AND picks most restrictive.

Workflow

1. Run audit against project directory
2. Review violations and warnings in output
3. For each violation, follow the recommendations provided
4. Optionally create .license-policy.json for custom rules
5. Add --ci flag to CI pipeline for automated enforcement