What is License Compliance?

Every dependency carries licence obligations, and some, copyleft terms in particular, can impose requirements on how you distribute your own software. Licence scanning identifies each package's licence, usually via SPDX identifiers, and checks it against an allowlist or blocklist.

This is legal risk rather than security risk, which is why it tends to be a procurement or compliance requirement rather than an engineering one. It matters most when shipping software to customers rather than running it as a service.

Top 12 License Compliance tools

Every tool in the directory documented as supporting License Compliance, 11 fully, 1 partially, with what its own documentation says.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

1. 1
   CodacyQuality PlatformTeam

   SPDX identification with allowlists, blocklists, category policies and license inventory reporting.

2. 2
   AikidoCode Security Platform

   SPDX identification, permitted/restricted/forbidden policies, org-wide enforcement, compliance reports

3. 3
   Checkmarx OneCode Security Platform

   Effective License designation, Full/Partial/No copyleft classification, license severity, and source-path evidence.

4. 4
   CodeAnt AIPR Review

   License compliance checking with risky-license identification as part of SCA

5. 5
   CorgeaCode Security PlatformGrowth

   SCA captures per-dependency license; enforced via blocking rule; License Enforcement named at Growth

6. 6
   DeepSourceQuality Platformadd-on

   SPDX license identification, category rules and custom overrides across transitive dependencies; rides on SCA billing.

7. 7
   GitHub Advanced SecurityCode Security PlatformFree on public repos; add-on: Code Security for private/internal

   dependency review deny-licenses blocks disallowed licenses; open source license compliance policy across repos

8. 8
   SemgrepCode Security Platform

   License detection with policies to flag or block disallowed licenses; all SCA languages except Dart and Elixir.

9. 9
   SnykCode Security Platform

   SPDX-aligned catalog, default severities, OR/AND dual licenses, custom license policies, org Licenses tab.

10. 10
    SonarQubeQuality Platformadd-on

    License policy management and enforcement ships inside the separately subscribed SCA product.

11. 11
    VeracodeCode Security Platformadd-on

    License-risk ratings per component; policy rules block high-risk, non-OSS or unrecognized licenses

12. 12
    Cursor (Bugbot)PR ReviewPartialPro

    Only via a custom BUGBOT.md rule naming specific licenses; no native license policy engine

What to look for

• Whether policies can be configured per licence category and per repository
• Detection of transitive dependency licences, not just direct ones
• How dual-licensed and unlicensed packages are handled
• Whether a merge can be blocked on a policy violation

Related terms

FAQ