日本語English

OSS License Report and NOTICE Draft (OSS License Report)

Paste a package-lock.json, a CycloneDX or SPDX SBOM, or a name,version,license CSV. The tool counts licenses by kind with a guide classification, and lists items to review such as GPL or AGPL family licenses and packages with no license. It can also draft a THIRD-PARTY-NOTICES file, without the full license texts. The classification is a guide, not legal advice.

On-device・No uploadMobile friendlyWorks offline

Your files and input are processed only inside your browser on this device and are never uploaded to our servers.

The license list is built only inside your browser. Nothing is sent to a server, and no registry is queried (no network requests). Classifications are guides, not legal advice.

Drop a file

or

One text file (up to 5 MB). Contents are not sent anywhere.Paste (Ctrl+V) also works
Paste a lock file, SBOM or CSV, or drop a file, to see the summary and the items to review.

How to use

  1. package-lock.json

    Paste lock, SBOM or CSV

  2. Count by licenseclassification is a guide

    Counts and items to review

  3. THIRD-PARTY-NOTICESno full texts

    Draft NOTICE

Paste a lock file or SBOM, count the licenses, then draft a NOTICE file

  1. Paste a package-lock.json (lockfileVersion 2 or 3), an SBOM (CycloneDX or SPDX, JSON or SPDX tag-value), or a name,version,license CSV. You can also drop a file or choose one. “Try a sample” shows how it works.

  2. In “Summary”, see the count for each license and its guide category: permissive, weak copyleft, strong copyleft, or unknown.

  3. In “To review”, check packages with no license, UNLICENSED, SEE LICENSE IN, NOASSERTION, GPL or AGPL family licenses, and identifiers not in the list.

  4. In “NOTICE draft”, choose plain text or Markdown, then copy or download it. It has no full license texts, so ship each package’s LICENSE file with it.

What it does

Reads SPDX expressions

Reads OR (as in MIT OR Apache-2.0), AND, WITH exceptions and parentheses. For the guide category, OR takes the looser option and AND takes the stricter one.

Detects the input format

Tells package-lock.json (the license field as a string, {type} or array), CycloneDX and SPDX SBOMs, and name,version,license CSV apart from the pasted text.

States the reason for each review item

Gives a reason for each item: no license, UNLICENSED, SEE LICENSE IN, NOASSERTION, an unreadable expression, GPL or AGPL family, or an identifier not in the list.

A NOTICE draft without full texts

Lists “name version” under each license. Full license texts are left out, and a note asks you to ship the LICENSE files with the notice.

Use cases

  • Attach a list of open source licenses to a product you distribute
  • Find which packages in a package-lock.json are GPL or AGPL family without searching by hand
  • Count licenses by kind for an internal audit or for a supplier question
  • Check a received SBOM for NOASSERTION or empty license fields

Capability matrix

FeatureSupportNotes
Listing from package-lock.json (lockfileVersion 2 and 3)Supported—
Listing from CycloneDX and SPDX SBOMs (JSON and tag-value)Supported—
Listing from a name,version,license CSVSupported—
SPDX expressions (AND, OR, WITH, parentheses) and guide classificationPartialClassifies about 40 common identifiers only. Others show as unknown.
Fetching licenses from a registryNot supportedNo network requests. Only the licenses written in the pasted content are used.
Judging the text of a LICENSE fileNot supportedLicense text is not read.
A NOTICE file with full license textsNot supportedFull texts are not included. Ship each package’s LICENSE file.
Judging legal complianceNot supportedThe classification is a guide, not legal advice.

Limits & notes

  • Up to 5 MB of input and 20,000 items per list. Larger input is not read, and you are told.
  • The classification is a guide based on about 40 common SPDX identifiers. It does not judge version differences or exception terms.
  • lockfileVersion 1 package-lock.json files are not supported, because they have no packages field.
  • The NOTICE draft does not include copyright lines or permission wording from the authors. Check each package’s LICENSE.

Privacy & safety

Pasted content is read only inside your browser. It is not sent to or stored on a server, and nothing is saved in the browser. Usage analytics never include content or file names.

FAQ

What should a NOTICE file contain?
For each license, the package name and version, each package’s copyright notice and license terms, and the full LICENSE text. This tool drafts the list only; it does not create the full texts.
If GPL or AGPL family licenses appear, can I not use them?
The tool does not decide that. It lists them for review as strong copyleft. Terms depend on how you distribute the software, so get a legal review.
How is an expression like MIT OR GPL-2.0-only classified?
For OR, the guide takes the looser choice. Here MIT can be chosen, so it counts as permissive. Which license you actually use is your decision.
What if an SBOM license is NOASSERTION?
NOASSERTION means the author did not confirm the license. It is listed for review, and you should check that package’s license at its source. The SBOM itself can be read in sbom_studio.
Does pasting a package-lock.json cause network requests?
No. Only the license fields written in the content are used. The tool does not contact a registry or npm.

Lockfile Diff & Dependency Tree

Compare two lockfiles to see which packages were added, removed or upgraded. You can also see why a package is installed and where several versions of one package come from. Nothing leaves your browser.

No upload

CSV Studio

Open CSV files that are slow or garbled in Excel and view, search and edit them right away in your browser. Combine, split and save as CSV (UTF-8 with BOM, Shift_JIS), Excel or JSON on one screen.

No upload

Markdown Studio — Live Editor & Preview

A split-view Markdown editor with instant GFM preview, a table formatter that aligns pipes, an automatic table of contents and HTML export. Output is always sanitized and external images load only when you allow them.

No upload

SBOM Viewer and Compare (SBOM Studio)

Paste a CycloneDX or SPDX SBOM, as JSON or SPDX tag-value, to list each component with its name, version, purl, license, supplier and hash, and draw the dependency relationships as a tree. It flags components with no purl or license, the same component at more than one version, and NOASSERTION licenses. Compare an old and a new SBOM to see what was added, removed, or changed in version or license. No vulnerability database is queried; only the vulnerabilities written in the SBOM are listed.

No upload

Docker Compose Studio

Convert docker run commands to compose.yaml, or compose.yaml back to docker run. A compose file is checked for syntax, the Compose Specification and common mistakes, and security points worth confirming are listed. Nothing is started or pulled, and your input never leaves your device.

No upload

Dockerfile Studio

Paste a Dockerfile to check its syntax, stages and common mistakes. Secret-looking values and points to confirm, such as curl | sh, are listed with line numbers. You can also format it or generate starter files for Node.js, Python, Go, a static site or Java. Nothing is built, and your input never leaves your device.

No upload

Last updated: