# OSS License Report and NOTICE Draft (OSS License Report)

Paste a package-lock.json, a CycloneDX or SPDX SBOM, or a name,version,license CSV. The tool counts licenses by kind with a guide classification, and lists items to review such as GPL or AGPL family licenses and packages with no license. It can also draft a THIRD-PARTY-NOTICES file, without the full license texts. The classification is a guide, not legal advice.

- URL: https://tools.itlibra.com/en/oss-license-report
- On-device・No upload
- Last updated: 2026-10-31

## How to use

1. Paste a package-lock.json (lockfileVersion 2 or 3), an SBOM (CycloneDX or SPDX, JSON or SPDX tag-value), or a name,version,license CSV. You can also drop a file or choose one. “Try a sample” shows how it works.
2. In “Summary”, see the count for each license and its guide category: permissive, weak copyleft, strong copyleft, or unknown.
3. In “To review”, check packages with no license, UNLICENSED, SEE LICENSE IN, NOASSERTION, GPL or AGPL family licenses, and identifiers not in the list.
4. In “NOTICE draft”, choose plain text or Markdown, then copy or download it. It has no full license texts, so ship each package’s LICENSE file with it.

## Use cases

- Attach a list of open source licenses to a product you distribute
- Find which packages in a package-lock.json are GPL or AGPL family without searching by hand
- Count licenses by kind for an internal audit or for a supplier question
- Check a received SBOM for NOASSERTION or empty license fields

## What it does

### Reads SPDX expressions

Reads OR (as in MIT OR Apache-2.0), AND, WITH exceptions and parentheses. For the guide category, OR takes the looser option and AND takes the stricter one.

### Detects the input format

Tells package-lock.json (the license field as a string, {type} or array), CycloneDX and SPDX SBOMs, and name,version,license CSV apart from the pasted text.

### States the reason for each review item

Gives a reason for each item: no license, UNLICENSED, SEE LICENSE IN, NOASSERTION, an unreadable expression, GPL or AGPL family, or an identifier not in the list.

### A NOTICE draft without full texts

Lists “name version” under each license. Full license texts are left out, and a note asks you to ship the LICENSE files with the notice.


## Capability matrix

| Feature | Support | Notes |
| --- | --- | --- |
| Listing from package-lock.json (lockfileVersion 2 and 3) | Supported | — |
| Listing from CycloneDX and SPDX SBOMs (JSON and tag-value) | Supported | — |
| Listing from a name,version,license CSV | Supported | — |
| SPDX expressions (AND, OR, WITH, parentheses) and guide classification | Partial | Classifies about 40 common identifiers only. Others show as unknown. |
| Fetching licenses from a registry | Not supported | No network requests. Only the licenses written in the pasted content are used. |
| Judging the text of a LICENSE file | Not supported | License text is not read. |
| A NOTICE file with full license texts | Not supported | Full texts are not included. Ship each package’s LICENSE file. |
| Judging legal compliance | Not supported | The classification is a guide, not legal advice. |

## Limits & notes

- Up to 5 MB of input and 20,000 items per list. Larger input is not read, and you are told.
- The classification is a guide based on about 40 common SPDX identifiers. It does not judge version differences or exception terms.
- lockfileVersion 1 package-lock.json files are not supported, because they have no packages field.
- The NOTICE draft does not include copyright lines or permission wording from the authors. Check each package’s LICENSE.

## Privacy & safety

Pasted content is read only inside your browser. It is not sent to or stored on a server, and nothing is saved in the browser. Usage analytics never include content or file names.

## FAQ

### What should a NOTICE file contain?

For each license, the package name and version, each package’s copyright notice and license terms, and the full LICENSE text. This tool drafts the list only; it does not create the full texts.

### If GPL or AGPL family licenses appear, can I not use them?

The tool does not decide that. It lists them for review as strong copyleft. Terms depend on how you distribute the software, so get a legal review.

### How is an expression like MIT OR GPL-2.0-only classified?

For OR, the guide takes the looser choice. Here MIT can be chosen, so it counts as permissive. Which license you actually use is your decision.

### What if an SBOM license is NOASSERTION?

NOASSERTION means the author did not confirm the license. It is listed for review, and you should check that package’s license at its source. The SBOM itself can be read in sbom\_studio.

### Does pasting a package-lock.json cause network requests?

No. Only the license fields written in the content are used. The tool does not contact a registry or npm.