Endor Labs License Compliance

Analyze dependency licenses for compliance risks and compatibility.

License Categories

Workflow

Step 1: Get License Findings

Use scan MCP tool with scantypes: ["dependencies"], scanoptions: { "quickscan": true }. Retrieve details via getresource (resource_type: Finding).

CLI fallback:

npx -y endorctl api list --resource Finding -n $ENDOR_NAMESPACE --filter "spec.finding_categories contains FINDING_CATEGORY_LICENSE_RISK" 2>/dev/null

For CLI field paths and parsing gotchas, read references/cli-parsing.md.

Step 2: Analyze Manifest Files

Read project manifests (package.json, go.mod, etc.) to build a complete license inventory.

Step 3: Present Results

## License Compliance Report

**Project:** {name} | **Dependencies Analyzed:** {count}

### License Summary

| Category | Count | Risk |
|----------|-------|------|
| Permissive (MIT, Apache, BSD) | {n} | Low |
| Weak Copyleft (LGPL, MPL) | {n} | Medium |
| Strong Copyleft (GPL, AGPL) | {n} | High |
| Unknown/No License | {n} | High |

### License Risks

| # | Package | License | Risk | Issue |
|---|---------|---------|------|-------|
| 1 | {pkg} | GPL-3.0 | High | Copyleft - may require open-sourcing |
| 2 | {pkg} | AGPL-3.0 | Critical | Network copyleft - affects SaaS |

For each high-risk finding, provide:
- Implications for proprietary vs. open-source projects
- Permissive-licensed alternatives
- Options: replace, isolate, accept copyleft, request exception

### Full License Inventory

| Package | License | Category | Risk |
|---------|---------|----------|------|

### Next Steps

1. `/endor-policy` — Enforce license rules
2. `/endor-scan` — Full security analysis
3. `/endor-cicd` — Add license checks to CI/CD

Compatibility Matrix

Commercial/Proprietary Projects

Open Source (MIT/Apache) Projects

For data source policy, read references/data-sources.md.

Error Handling