• Overview
• Repo check
• Classifier
• SBOM checker
• Licences
• CRA Index
• security.txt

Licence notices and licence check from an SBOM

Drop a CycloneDX or SPDX JSON file. You get a ready THIRD-PARTY-NOTICES text, the licences grouped by type (permissive, weak copyleft, strong copyleft, unknown) and the risks that follow for your own licence. The file is read in your browser and is not uploaded.

The categories and risks are rules of thumb on the licence names in your SBOM. Licences have conditions that depend on how a component is used; a licence name in an SBOM can also be wrong. Not legal advice.

Information generated from your inputs, with article references to Regulation (EU) 2024/2847. It is not legal advice and does not replace your own assessment; check the references against the Official Journal.