Security scanning

What is license compliance?

Identifying the licenses of your dependencies and flagging ones that conflict with your policy.

By Cláudia FernandesUpdated 2026-10-02

Every dependency carries license obligations, and some, copyleft terms in particular, can impose requirements on how you distribute your own software. License scanning identifies each package's license, usually via SPDX identifiers, and checks it against an allowlist or blocklist.

This is legal risk rather than security risk, which is why it tends to be a procurement or compliance requirement rather than an engineering one. It matters most when distributing software to customers, though network copyleft licenses such as the AGPL also cover software offered as a hosted service.

What to look for

Whether policies can be configured per license category and per repository
Detection of transitive dependency licenses, not just direct ones
How dual-licensed and unlicensed packages are handled
Whether a merge can be blocked on a policy violation

Best 12 license compliance tools

Every tool in the directory whose documentation covers this, 11 fully and 1 partially. Full support is shown first. Shown in a random order that changes on every visit, so no tool gets an advantage from its position.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

Code Security Platform

Aikido

SPDX identification, permitted/restricted/forbidden policies, org-wide enforcement, compliance reports

Code Security Platform

Checkmarx One

Effective License designation, Full/Partial/No copyleft classification, license severity, and source-path evidence.

Code Quality Platform

Codacy

SPDX identification with allowlists, blocklists, category policies and license inventory reporting.

PR Review Tool

CodeAnt AI

License compliance checking with risky-license identification as part of SCA

Code Security Platform

Corgea

SCA captures per-dependency license; enforced via blocking rule; License Enforcement named at Growth

Code Quality Platform

DeepSource

SPDX license identification, category rules and custom overrides across transitive dependencies; rides on SCA billing.

Code Security Platform

GitHub Advanced Security

dependency review deny-licenses blocks disallowed licenses; open source license compliance policy across repos

Code Security Platform

Semgrep

License detection with policies to flag or block disallowed licenses; all SCA languages except Dart and Elixir.

Code Security Platform

Snyk

SPDX-aligned catalog, default severities, OR/AND dual licenses, custom license policies, org Licenses tab.

Code Quality Platform

SonarQube

License policy management and enforcement ships inside the separately subscribed SCA product.

Code Security Platform

Veracode

License-risk ratings per component; policy rules block high-risk, non-OSS or unrecognized licenses

PR Review Tool

Cursor (Bugbot)

Only via a custom BUGBOT.md rule naming specific licenses; no native license policy engine

SAST Taint Analysis (Data-Flow)Secrets Detection Secrets Validation SCA Reachability Analysis

FAQ