usefulweb.site SBOM License Checker

Security & supply-chain explorers

SBOM License Checker

Check SBOM licences: SPDX expressions, copyleft class and conflicts with your project licence.

Try an example: CycloneDX XML Java service (Apache-2.0 project) · SPDX tag-value firmware (proprietary, distributed) · Same firmware as a GPL-2.0-only project

How it works

Upload or paste a CycloneDX (JSON or XML) or SPDX (JSON or tag-value) SBOM. Every component licence is parsed as an SPDX expression (AND, OR, WITH), normalised against a bundled SPDX licence list subset (name, OSI approval, permissive / weak / strong / network copyleft) and checked against the licence of your project or product with a documented compatibility matrix. Missing and unknown licences are flagged. Not legal advice.

  • Readers: CycloneDX JSON and SPDX 2.x JSON via the SBOM Explorer parser; CycloneDX XML (components, nested components, metadata component, license id/name/expression) and SPDX tag-value (PackageName, PackageVersion, PackageLicenseConcluded, else PackageLicenseDeclared, purl ExternalRefs) with our own readers. Several CycloneDX licence entries for one component are combined with AND (conservative).
  • Licence strings are parsed as SPDX license expressions (SPDX spec Annex D: WITH binds tighter than AND, AND tighter than OR, parentheses, “+”). Deprecated ids (GPL-2.0, GPL-2.0+, LGPL-2.1, GPL-2.0-with-classpath-exception …) are mapped to current ids; common free-text names (“Apache 2.0”, “The MIT License”, “GPLv3”) are normalised and the mapping is reported.
  • Licence data: a bundled subset of 114 licences from the SPDX License List 3.29.0 (2026-09-16): id, name and OSI approval from SPDX; the copyleft class (public domain, permissive, weak, strong, network, source-available) is our classification.
  • Compatibility: each licence is rated against the project licence with the matrix shown in the results (ok, conditions, review, conflict, unknown). OR takes the best option, AND the worst. Linking exceptions (Classpath, GCC, LLVM, Autoconf, Bison, Universal FOSS …) reduce GPL components to weak copyleft. The matrix encodes widely documented positions (FSF licence list, MPL-2.0 §3.3, GPL-3.0 §13, Apache-2.0/GPL-2.0 incompatibility); edge cases depend on how components are combined.
  • Not legal advice: obligations depend on linking, distribution, modification and jurisdiction. Use the result to decide what needs legal review.

Not legal advice. Licence compatibility depends on how components are used, linked and distributed.

Sources

For scripts and AI agents

  • JSON API: POST https://sbomlicensechecker.usefulweb.site/api/v1/calculate (same calculation as this page)
  • Interface description: OpenAPI 3.1 · AI guide: llms.txt
  • MCP server (Streamable HTTP): https://sbomlicensechecker.usefulweb.site/mcp · tool name sbom_license_checker
Example request
curl -s -X POST https://sbomlicensechecker.usefulweb.site/api/v1/calculate \
  -H 'content-type: application/json' \
  -d '{…see OpenAPI examples…}'

Related tools

  • SBOM Explorer – Open a CycloneDX or SPDX SBOM: components, licences, dependency tree and known vulnerabilities.
  • Dependency Vulnerability Explorer – Known vulnerabilities in your dependencies, and the version that fixes each one.
Feedback