License Checker
Paste an SBOM or dependency license list, set allow/deny rules with SPDX IDs or license categories, and get a PASS/FAIL compliance report. Runs in your browser; nothing is uploaded.
About this tool
License Checker evaluates SPDX license metadata from an SBOM or dependency inventory against a policy you paste into the form. It is meant for quick CI policy design, PR review, and one-off audits where you already have the package list and want a deterministic PASS/FAIL report.
It accepts common inventory shapes:
- CycloneDX JSON SBOMs (
components[].licenses). - SPDX JSON or SPDX tag-value documents.
- npm-style JSON maps such as
{ "[email protected]": { "licenses": "MIT" } }. - Plain lists:
name@version: MIT,name,version,MIT, orname MIT.
Rules can be exact SPDX identifiers (MIT, Apache-2.0 WITH LLVM-exception) or
license-family categories such as category:permissive,
category:strong-copyleft, and category:network-copyleft. SPDX expressions are
evaluated rather than string-matched: MIT OR Apache-2.0 passes if either branch
is allowed, while MIT AND GPL-3.0-only requires both branches to be acceptable.
Worked example
Paste this dependency list:
[email protected]: MIT
[email protected]: GPL-3.0-only
[email protected]: MIT OR Apache-2.0
[email protected]: NOASSERTION
Set Allowed licenses/categories to:
MIT, Apache-2.0, category:public-domain
The report fails copyleft-lib, accepts the MIT OR Apache-2.0 expression, and
warns about the missing license on mystery unless you change Missing license
policy to allow or deny.
Limits and edge cases
- This is not legal advice; the category map is a practical compliance grouping.
- It does not crawl
node_modules, Cargo workspaces, or package registries. Use an SBOM generator first, then paste the SBOM here. - It validates common SPDX identifiers and exceptions, but custom
LicenseRef-*values are treated as valid SPDX custom identifiers. - Package exceptions are explicit and reproducible: pass
nameorname@version; no decision state is saved between runs.
FAQ
Can this scan my repository and discover dependency licenses?
No. This tool checks license metadata you already have. Generate a CycloneDX or SPDX SBOM with your build tooling, or paste a dependency list, then use this checker to apply allow/deny rules locally in the browser.
How do OR and AND SPDX expressions affect the verdict?
OR means the package offers alternatives, so the expression is accepted when at
least one branch is allowed and not denied. AND means multiple obligations
apply, so every branch must be acceptable. A deny rule always wins over an allow
rule.
What is the difference between unlisted and unknown?
Unlisted means a package has a license, but it does not match any allow rule
when an allow list is configured. Unknown means the package has no usable
license metadata at all, such as NOASSERTION or an empty field. Each has its
own allow/warn/deny policy.
Why use category rules instead of listing every SPDX ID?
Categories let you express a posture, such as allowing permissive licenses while denying strong and network copyleft families. You can still mix exact SPDX IDs with category tokens when a specific license needs special treatment.
Developer & Automation Access
Run it from the terminal
Same engine as this page, headless — via the gizza CLI:
gizza tool license-checker "[email protected]: MIT
[email protected]: GPL-3.0-only
[email protected]: MIT OR Apache-2.0
[email protected]: NOASSERTION"New to the CLI? Get gizza →
Open it by URL
Pre-fill and auto-run this tool with query parameters — the names match the API/CLI:
https://gizza.ai/tools/license-checker/?dependencies=chalk%404.1.2%3A%20MIT%0Acopyleft-lib%402.0.0%3A%20GPL-3.0-only%0Adual%401.0.0%3A%20MIT%20OR%20Apache-2.0%0Amystery%400.1.0%3A%20NOASSERTION&input_format=auto&allow=MIT%2C%20Apache-2.0%2C%20category%3Apublic-domain&deny=category%3Astrong-copyleft%2C%20category%3Anetwork-copyleft%2C%20SSPL-1.0&exceptions=legacy-widget%2C%20my-gpl-tool%402.1.0&unlisted=deny&unknown=warn&validate_ids=true&include_allowed=true&output=textMachine-readable descriptor: tool.json — title + parameters JSON Schema for agents.