# SBOM License Checker

> Check SBOM licences: SPDX expressions, copyleft class and conflicts with your project licence. Upload or paste a CycloneDX (JSON or XML) or SPDX (JSON or tag-value) SBOM. Every component licence is parsed as an SPDX expression (AND, OR, WITH), normalised against a bundled SPDX licence list subset (name, OSI approval, permissive / weak / strong / network copyleft) and checked against the licence of your project or product with a documented compatibility matrix. Missing and unknown licences are flagged. Not legal advice.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://sbomlicensechecker.usefulweb.site/ (interactive tool at https://sbomlicensechecker.usefulweb.site/tool)
- JSON API: POST https://sbomlicensechecker.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://sbomlicensechecker.usefulweb.site/api/v1/tool)
- OpenAPI: https://sbomlicensechecker.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://sbomlicensechecker.usefulweb.site/mcp - tool `sbom_license_checker`

## Inputs
- sbom (textarea): SBOM (CycloneDX JSON/XML or SPDX JSON/tag-value)
- sbomFile (file): Or upload an SBOM file
- projectLicense (select): Your project / product licence

## Method
- Readers: CycloneDX JSON and SPDX 2.x JSON via the SBOM Explorer parser; CycloneDX XML (components, nested components, metadata component, license id/name/expression) and SPDX tag-value (PackageName, PackageVersion, PackageLicenseConcluded, else PackageLicenseDeclared, purl ExternalRefs) with our own readers. Several CycloneDX licence entries for one component are combined with AND (conservative).
- Licence strings are parsed as SPDX license expressions (SPDX spec Annex D: WITH binds tighter than AND, AND tighter than OR, parentheses, “+”). Deprecated ids (GPL-2.0, GPL-2.0+, LGPL-2.1, GPL-2.0-with-classpath-exception …) are mapped to current ids; common free-text names (“Apache 2.0”, “The MIT License”, “GPLv3”) are normalised and the mapping is reported.
- Licence data: a bundled subset of 114 licences from the SPDX License List 3.29.0 (2026-09-16): id, name and OSI approval from SPDX; the copyleft class (public domain, permissive, weak, strong, network, source-available) is our classification.
- Compatibility: each licence is rated against the project licence with the matrix shown in the results (ok, conditions, review, conflict, unknown). OR takes the best option, AND the worst. Linking exceptions (Classpath, GCC, LLVM, Autoconf, Bison, Universal FOSS …) reduce GPL components to weak copyleft. The matrix encodes widely documented positions (FSF licence list, MPL-2.0 §3.3, GPL-3.0 §13, Apache-2.0/GPL-2.0 incompatibility); edge cases depend on how components are combined.
- Not legal advice: obligations depend on linking, distribution, modification and jurisdiction. Use the result to decide what needs legal review.

## Limits
- Not legal advice. Licence compatibility depends on how components are used, linked and distributed.