Authentication Required
License Intelligence requires authentication to access license intelligence data.
OSS License Intelligence
Comprehensive license risk analysis for open source packages with SPDX normalization, compliance guidance, and policy decisions.
About License Risk Scoring
License risk is now part of the PS-SSF/OSS scoring formula (12% weight).
Licenses are classified by their compliance obligations: Permissive licenses (MIT, Apache) have minimal requirements,
while Network Copyleft licenses (AGPL) require source disclosure for SaaS deployments.
Unknown or proprietary licenses are treated as high risk.
-
Total Packages
-
License Coverage
-
Permissive
-
Copyleft
-
High Risk
-
Unknown
How We Discover & Classify Licenses
1
Data Sources
License information is collected from multiple sources:
- deps.dev API - Google's package intelligence (primary)
- Package manifests - package.json, setup.py, Cargo.toml
- GitHub License API - Repository license detection
- OSV Database - Vulnerability-linked package data
2
SPDX Normalization
Raw license strings are normalized to SPDX identifiers:
- "Apache 2.0" →
Apache-2.0 - "MIT License" →
MIT - "GPLv3" →
GPL-3.0-only - 90+ alias mappings in our registry
3
Risk Classification
Each license is classified using our license_risk_map.json registry:
- Category - Permissive, Copyleft, Proprietary, etc.
- Risk Score - 0.0 (safe) to 1.0 (high risk)
- Policy - Allow, Review, or Deny
- OSI Approved - Open Source Initiative status
4
PS-SSF/OSS Integration
License risk is integrated into the Phoenix Security Score (v3.0):
- 12% weight in PS-SSF/OSS formula
- Combined with security vulnerabilities
- Affects package risk prioritization
- Shown on CVE and Package detail pages
Coverage Note:
License data is available for packages indexed by deps.dev. Packages without license information are marked as "Unknown" with high risk until verified.
Run
rebuild_license_intelligence.py --max-api 2000 to fetch more license data from the deps.dev API.
License Categories
Risk Distribution
License Categories & Compliance Guide
Package License Table
| Package | License | Category | Risk | Policy | Vulns |
|---|
Page 1 of 1
Loading license intelligence...