License Compliance Python Packages

continuous-delivery-scripts

Git-based CI/CD tools for semantic releases, changelogs, SPDX SBOMs, third-party IP and licence reports

aboutcode-pipeline

ScanCode.io is a server to script and automate software composition analysis with pipelines. This project is sponsored by the European Commission, NLnet NGI0, the Google Summer of Code, nexB and others generous sponsors!

pixi-sbom

pixi-sbom is a Pixi extension that generates Software Bills of Materials (SBOMs) from Pixi manifests and lock files, supporting dependency visibility, reproducibility, and supply-chain security workflows.

scancodeio

ScanCode.io is a server to script and automate software composition analysis with pipelines. This project is sponsored by the European Commission, NLnet NGI0, the Google Summer of Code, nexB and others generous sponsors!

pdf-tooling

Apache-2.0 PDF toolkit CLI in Python: merge, split, extract, rotate, PDF→images, images→PDF, create, text/tables, compress, encrypt, metadata, watermark, OCR, Office→PDF

licenseal

Fast cross-ecosystem dependency license compatibility checker + Claude Code review skill

license-compliance-checker

Multi-ecosystem license + AI model scanner for EU AI Act Article 53 GPAI compliance. CycloneDX/SPDX SBOM, training-data risk. Apache 2.0.

compliance-assistant

Toolset that helps you with creating and interacting with SBOMs, enriching with licensing and copyright information, and checking for Open Source license compliance

mcp-semclone

mcp-semclone - Model Context Protocol Server for SEMCL.ONE

ossbomer

Profile-driven SBOM validation, conformance, and license policy (SPDX / CycloneDX)

onot

Generate open source software notices (OSS Notice) from SBOM documents — SPDX, CycloneDX, Excel → HTML/Text/Markdown/PDF. Offline, type-safe Python core with CLI, local API, and an installable desktop app.

oslili

OSLILI - Open Source License Identification Library

oslili-cli

CLI for OSLiLi

pkgguard-cli

Vet the packages & repos your AI assistant recommended — before you install. Catches hallucinated/slopsquatted names, CVEs, malware, fake stars, and license traps in 25 languages. MCP server so the assistant checks itself. No API key.

sorb

Dependency analysis and SBOM generation for code, containers and binaries

obligo

Deployment-context-aware license compliance scanner — evaluates the obligations your deployment actually triggers (SUL, BSL, SSPL, Elastic, GPL/AGPL…), not just license names. Scans codebases, lockfiles, Docker images, SSH hosts, and k8s.