Endor Labs License Compliance
Analyze dependency licenses for compliance risks and compatibility.
License Categories
| Category |
Licenses |
Risk |
| Permissive |
MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, Unlicense, CC0-1.0 |
Low |
| Weak Copyleft |
LGPL-2.1, LGPL-3.0, MPL-2.0, EPL-2.0, CDDL-1.0 |
Medium |
| Strong Copyleft |
GPL-2.0, GPL-3.0, AGPL-3.0, SSPL, OSL-3.0 |
High |
| Unknown/None |
No license, custom, proprietary, UNLICENSED |
High |
Workflow
Step 1: Get License Findings
Use scan MCP tool with scan_types: ["dependencies"], scan_options: { "quick_scan": true }. Retrieve details via get_resource (resource_type: Finding).
CLI fallback:
npx -y endorctl api list --resource Finding -n $ENDOR_NAMESPACE --filter "spec.finding_categories contains FINDING_CATEGORY_LICENSE_RISK" 2>/dev/null
For CLI field paths and parsing gotchas, read references/cli-parsing.md.
Step 2: Analyze Manifest Files
Read project manifests (package.json, go.mod, etc.) to build a complete license inventory.
Step 3: Present Results
## License Compliance Report
**Project:** {name} | **Dependencies Analyzed:** {count}
### License Summary
| Category | Count | Risk |
|----------|-------|------|
| Permissive (MIT, Apache, BSD) | {n} | Low |
| Weak Copyleft (LGPL, MPL) | {n} | Medium |
| Strong Copyleft (GPL, AGPL) | {n} | High |
| Unknown/No License | {n} | High |
### License Risks
| # | Package | License | Risk | Issue |
|---|---------|---------|------|-------|
| 1 | {pkg} | GPL-3.0 | High | Copyleft - may require open-sourcing |
| 2 | {pkg} | AGPL-3.0 | Critical | Network copyleft - affects SaaS |
For each high-risk finding, provide:
- Implications for proprietary vs. open-source projects
- Permissive-licensed alternatives
- Options: replace, isolate, accept copyleft, request exception
### Full License Inventory
| Package | License | Category | Risk |
|---------|---------|----------|------|
### Next Steps
1. `/endor-policy` — Enforce license rules
2. `/endor-scan` — Full security analysis
3. `/endor-cicd` — Add license checks to CI/CD
Compatibility Matrix
Commercial/Proprietary Projects
| License |
Compatible |
Action |
| MIT, Apache, BSD |
Yes |
Allow |
| LGPL |
Review |
Check linking method |
| GPL, AGPL |
No |
Block or replace |
| Unknown |
No |
Block until resolved |
Open Source (MIT/Apache) Projects
| License |
Compatible |
Action |
| MIT, Apache, BSD, LGPL |
Yes |
Allow |
| GPL |
Partial |
May affect project license |
| AGPL |
No |
Block or replace |
For data source policy, read references/data-sources.md.
Error Handling
| Error |
Action |
| No license findings |
No scan run — suggest /endor-scan |
| Auth error |
Suggest /endor-setup |
1---2name: endor-license3description: Analyze dependency license compliance and identify license risks. Use when the user says "check licenses", "license compliance", "any GPL dependencies", "copyleft risk", "endor license", or wants to know if dependencies are compatible with their project license. Flags copyleft (GPL, AGPL), unknown, and no-license packages. Do NOT use for vulnerability scanning (/endor-sca) or policy enforcement (/endor-policy).4---56# Endor Labs License Compliance78Analyze dependency licenses for compliance risks and compatibility.910## License Categories1112| Category | Licenses | Risk |13|----------|----------|------|14| Permissive | MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, Unlicense, CC0-1.0 | Low |15| Weak Copyleft | LGPL-2.1, LGPL-3.0, MPL-2.0, EPL-2.0, CDDL-1.0 | Medium |16| Strong Copyleft | GPL-2.0, GPL-3.0, AGPL-3.0, SSPL, OSL-3.0 | High |17| Unknown/None | No license, custom, proprietary, UNLICENSED | High |1819## Workflow2021### Step 1: Get License Findings2223Use `scan` MCP tool with `scan_types: ["dependencies"]`, `scan_options: { "quick_scan": true }`. Retrieve details via `get_resource` (resource_type: `Finding`).2425CLI fallback:26```bash27npx -y endorctl api list --resource Finding -n $ENDOR_NAMESPACE --filter "spec.finding_categories contains FINDING_CATEGORY_LICENSE_RISK" 2>/dev/null28```2930For CLI field paths and parsing gotchas, read references/cli-parsing.md.3132### Step 2: Analyze Manifest Files3334Read project manifests (package.json, go.mod, etc.) to build a complete license inventory.3536### Step 3: Present Results3738```markdown39## License Compliance Report4041**Project:** {name} | **Dependencies Analyzed:** {count}4243### License Summary4445| Category | Count | Risk |46|----------|-------|------|47| Permissive (MIT, Apache, BSD) | {n} | Low |48| Weak Copyleft (LGPL, MPL) | {n} | Medium |49| Strong Copyleft (GPL, AGPL) | {n} | High |50| Unknown/No License | {n} | High |5152### License Risks5354| # | Package | License | Risk | Issue |55|---|---------|---------|------|-------|56| 1 | {pkg} | GPL-3.0 | High | Copyleft - may require open-sourcing |57| 2 | {pkg} | AGPL-3.0 | Critical | Network copyleft - affects SaaS |5859For each high-risk finding, provide:60- Implications for proprietary vs. open-source projects61- Permissive-licensed alternatives62- Options: replace, isolate, accept copyleft, request exception6364### Full License Inventory6566| Package | License | Category | Risk |67|---------|---------|----------|------|6869### Next Steps70711. `/endor-policy` — Enforce license rules722. `/endor-scan` — Full security analysis733. `/endor-cicd` — Add license checks to CI/CD74```7576## Compatibility Matrix7778### Commercial/Proprietary Projects7980| License | Compatible | Action |81|---------|-----------|--------|82| MIT, Apache, BSD | Yes | Allow |83| LGPL | Review | Check linking method |84| GPL, AGPL | No | Block or replace |85| Unknown | No | Block until resolved |8687### Open Source (MIT/Apache) Projects8889| License | Compatible | Action |90|---------|-----------|--------|91| MIT, Apache, BSD, LGPL | Yes | Allow |92| GPL | Partial | May affect project license |93| AGPL | No | Block or replace |9495For data source policy, read references/data-sources.md.9697## Error Handling9899| Error | Action |100|-------|--------|101| No license findings | No scan run — suggest `/endor-scan` |102| Auth error | Suggest `/endor-setup` |
endorlabs