# License Checker
Check SPDX licenses in an SBOM or dependency list against allow/deny rules. Supports CycloneDX, SPDX, npm-style JSON, CSV-ish lists, JSON/CSV output.
## Run it
- **CLI:** `gizza tool license-checker "chalk@4.1.2: MIT
copyleft-lib@2.0.0: GPL-3.0-only
dual@1.0.0: MIT OR Apache-2.0
mystery@0.1.0: NOASSERTION"`
- **Web:** https://gizza.ai/tools/license-checker/
- **Agents:** machine-readable descriptor (parameters JSON Schema) at https://gizza.ai/tools/license-checker/tool.json
## Inputs
- `dependencies` — SBOM or dependency list _(field)_
- `input_format` — Input format _(field)_
- `allow` — Allowed licenses/categories _(field)_
- `deny` — Denied licenses/categories _(field)_
- `exceptions` — Package exceptions _(field)_
- `unlisted` — Unlisted license policy _(field)_
- `unknown` — Missing license policy _(field)_
- `validate_ids` — Validate SPDX identifiers _(field)_
- `include_allowed` — Include allowed packages _(field)_
- `output` — Output format _(field)_
## Output
- Compliance report (text)
## Query parameters
Open the tool pre-filled and auto-run via URL:
- `dependencies` — SBOM or dependency list
- `input_format` — Input format
- `allow` — Allowed licenses/categories
- `deny` — Denied licenses/categories
- `exceptions` — Package exceptions
- `unlisted` — Unlisted license policy
- `unknown` — Missing license policy
- `validate_ids` — Validate SPDX identifiers
- `include_allowed` — Include allowed packages
- `output` — Output format
Example: `https://gizza.ai/tools/license-checker/?dependencies=chalk%404.1.2%3A%20MIT%0Acopyleft-lib%402.0.0%3A%20GPL-3.0-only%0Adual%401.0.0%3A%20MIT%20OR%20Apache-2.0%0Amystery%400.1.0%3A%20NOASSERTION&input_format=auto&allow=MIT%2C%20Apache-2.0%2C%20category%3Apublic-domain&deny=category%3Astrong-copyleft%2C%20category%3Anetwork-copyleft%2C%20SSPL-1.0&exceptions=legacy-widget%2C%20my-gpl-tool%402.1.0&unlisted=deny&unknown=warn&validate_ids=true&include_allowed=true&output=text`
---
## About this tool
**License Checker** evaluates SPDX license metadata from an SBOM or dependency
inventory against a policy you paste into the form. It is meant for quick CI
policy design, PR review, and one-off audits where you already have the package
list and want a deterministic PASS/FAIL report.
It accepts common inventory shapes:
- CycloneDX JSON SBOMs (`components[].licenses`).
- SPDX JSON or SPDX tag-value documents.
- npm-style JSON maps such as `{ "pkg@1.0.0": { "licenses": "MIT" } }`.
- Plain lists: `name@version: MIT`, `name,version,MIT`, or `name MIT`.
Rules can be exact SPDX identifiers (`MIT`, `Apache-2.0 WITH LLVM-exception`) or
license-family categories such as `category:permissive`,
`category:strong-copyleft`, and `category:network-copyleft`. SPDX expressions are
evaluated rather than string-matched: `MIT OR Apache-2.0` passes if either branch
is allowed, while `MIT AND GPL-3.0-only` requires both branches to be acceptable.
### Worked example
Paste this dependency list:
```text
chalk@4.1.2: MIT
copyleft-lib@2.0.0: GPL-3.0-only
dual@1.0.0: MIT OR Apache-2.0
mystery@0.1.0: NOASSERTION
```
Set **Allowed licenses/categories** to:
```text
MIT, Apache-2.0, category:public-domain
```
The report fails `copyleft-lib`, accepts the `MIT OR Apache-2.0` expression, and
warns about the missing license on `mystery` unless you change **Missing license
policy** to `allow` or `deny`.
### Limits and edge cases
- This is not legal advice; the category map is a practical compliance grouping.
- It does not crawl `node_modules`, Cargo workspaces, or package registries. Use
an SBOM generator first, then paste the SBOM here.
- It validates common SPDX identifiers and exceptions, but custom `LicenseRef-*`
values are treated as valid SPDX custom identifiers.
- Package exceptions are explicit and reproducible: pass `name` or
`name@version`; no decision state is saved between runs.
## FAQ
Can this scan my repository and discover dependency licenses?
No. This tool checks license metadata you already have. Generate a CycloneDX or
SPDX SBOM with your build tooling, or paste a dependency list, then use this
checker to apply allow/deny rules locally in the browser.
How do OR and AND SPDX expressions affect the verdict?
`OR` means the package offers alternatives, so the expression is accepted when at
least one branch is allowed and not denied. `AND` means multiple obligations
apply, so every branch must be acceptable. A deny rule always wins over an allow
rule.
What is the difference between unlisted and unknown?
**Unlisted** means a package has a license, but it does not match any allow rule
when an allow list is configured. **Unknown** means the package has no usable
license metadata at all, such as `NOASSERTION` or an empty field. Each has its
own allow/warn/deny policy.
Why use category rules instead of listing every SPDX ID?
Categories let you express a posture, such as allowing permissive licenses while
denying strong and network copyleft families. You can still mix exact SPDX IDs
with category tokens when a specific license needs special treatment.
## Related tools
- [SBOM Diff](https://gizza.ai/tools/sbom-diff/): Diff two package-lock.json, Cargo.lock, requirements.txt, or CycloneDX/SPDX SBOMs and see added, removed, and version-bumped dependencies. Runs locally in your browser.
- [SBOM Generator](https://gizza.ai/tools/sbom-generator/): Generate CycloneDX or SPDX SBOMs from package-lock.json, Cargo.lock, or requirements.txt. Runs locally in your browser.
- [Apply a Unified Diff to a File](https://gizza.ai/tools/apply-patch/): Paste a file and a unified diff to get the patched text in your browser, with reverse apply, fuzz matching, and per-hunk conflict reports.
- [Autocomplete Trie](https://gizza.ai/tools/autocomplete-trie/): Build a prefix trie from a pasted wordlist and get ranked autocomplete suggestions for any typed prefix. Weights, typo tolerance, trie stats, JSON. Runs locally.
- [Code Chunker](https://gizza.ai/tools/code-chunker/): Split Python, Rust, JavaScript, TypeScript, Go, Java, C/C++, C#, PHP, or Swift into line-ranged chunks that keep functions and classes intact.