endor-license

name

endor-license

description

Analyze dependency license compliance and identify license risks. Use when the user says "check licenses", "license compliance", "any GPL dependencies", "copyleft risk", "endor license", or wants to know if dependencies are compatible with their project license. Flags copyleft (GPL, AGPL), unknown, and no-license packages. Do NOT use for vulnerability scanning (/endor-sca) or policy enforcement (/endor-policy).

Endor Labs License Compliance

Analyze dependency licenses for compliance risks and compatibility.

License Categories

Category	Licenses	Risk
Permissive	MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, Unlicense, CC0-1.0	Low
Weak Copyleft	LGPL-2.1, LGPL-3.0, MPL-2.0, EPL-2.0, CDDL-1.0	Medium
Strong Copyleft	GPL-2.0, GPL-3.0, AGPL-3.0, SSPL, OSL-3.0	High
Unknown/None	No license, custom, proprietary, UNLICENSED	High

Workflow

Step 1: Get License Findings

Use scan MCP tool with scan_types: ["dependencies"], scan_options: { "quick_scan": true }. Retrieve details via get_resource (resource_type: Finding).

CLI fallback:

npx -y endorctl api list --resource Finding -n $ENDOR_NAMESPACE --filter "spec.finding_categories contains FINDING_CATEGORY_LICENSE_RISK" 2>/dev/null

For CLI field paths and parsing gotchas, read references/cli-parsing.md.

Step 2: Analyze Manifest Files

Read project manifests (package.json, go.mod, etc.) to build a complete license inventory.

Step 3: Present Results

## License Compliance Report

**Project:** {name} | **Dependencies Analyzed:** {count}

### License Summary

| Category | Count | Risk |
|----------|-------|------|
| Permissive (MIT, Apache, BSD) | {n} | Low |
| Weak Copyleft (LGPL, MPL) | {n} | Medium |
| Strong Copyleft (GPL, AGPL) | {n} | High |
| Unknown/No License | {n} | High |

### License Risks

| # | Package | License | Risk | Issue |
|---|---------|---------|------|-------|
| 1 | {pkg} | GPL-3.0 | High | Copyleft - may require open-sourcing |
| 2 | {pkg} | AGPL-3.0 | Critical | Network copyleft - affects SaaS |

For each high-risk finding, provide:
- Implications for proprietary vs. open-source projects
- Permissive-licensed alternatives
- Options: replace, isolate, accept copyleft, request exception

### Full License Inventory

| Package | License | Category | Risk |
|---------|---------|----------|------|

### Next Steps

1. `/endor-policy` — Enforce license rules
2. `/endor-scan` — Full security analysis
3. `/endor-cicd` — Add license checks to CI/CD

Compatibility Matrix

Commercial/Proprietary Projects

License	Compatible	Action
MIT, Apache, BSD	Yes	Allow
LGPL	Review	Check linking method
GPL, AGPL	No	Block or replace
Unknown	No	Block until resolved

Open Source (MIT/Apache) Projects

License	Compatible	Action
MIT, Apache, BSD, LGPL	Yes	Allow
GPL	Partial	May affect project license
AGPL	No	Block or replace

For data source policy, read references/data-sources.md.

Error Handling

Error	Action
No license findings	No scan run — suggest /endor-scan
Auth error	Suggest /endor-setup