A self-hosted autonomous agent that audits the open-source licenses of your dependencies before you ship. It reads requirements.txt / package.json, maps each dependency to its SPDX license, classifies the risk (permissive, copyleft, proprietary, unknown) and grades it against a policy you control.

The problem it solves

Every release quietly pulls in dozens of transitive dependencies. One GPL or AGPL package linked into a product you distribute (or run as SaaS) can force you to open-source your own code; one "unknown" license is a compliance blind spot your legal team will find after launch. Checking this by hand does not scale, and it is exactly the kind of repetitive, rule-based verification an agent should own.

This agent turns that recurring chore into a one-command, offline, reproducible audit — with a clear allow / warn / deny verdict per dependency and a machine- readable report you can wire into CI.

Who it is for: engineers and release managers shipping software (libraries, apps, SaaS) who need a fast, honest license gate without a paid SCA platform.

What it does

Scan a manifest and list its declared dependencies (Python + npm).
Classify each dependency's license into a category using a bundled, buyer-extendable SPDX knowledge base (data/known_licenses.json).
Grade each category against your policy (data/policy.json): allow | warn | deny.
Flag copyleft contamination (GPL/AGPL/LGPL/MPL), proprietary terms and unknown provenance so nothing ships unreviewed.
Gate CI with --strict (exit code 2 on any denied license).
Explain & remediate a risky package (permissive alternatives), enriched by your own LLM CLI when one is connected.

Architecture

        ┌──────────────────────────────────────────────────────────┐
        │  Manifests: requirements.txt / package.json              │
        └───────────────────────────┬──────────────────────────────┘
                                     ▼
        ┌──────────────────────────────────────────────────────────┐
        │           OODA loop (deterministic core)                 │
        │  OBSERVE  → discover manifests under the scan dir         │
        │  ORIENT   → parse dependencies (name + version)          │
        │  DECIDE   → SPDX license → category → policy verdict      │
        │  ACT      → report + violations + exit code              │
        └───────────────────────────┬──────────────────────────────┘
                                     ▼
        ┌──────────────────────────────────────────────────────────┐
        │  Knowledge base (data/*.json)   ·   BYO-LLM adapter       │
        │  known_licenses / categories / policy   (claude/kimi/codex)│
        └──────────────────────────────────────────────────────────┘

File	Role
`README.md`	This file — overview and quick-start
`SOUL.md`	Mission, values and the license-audit OODA states
`PROMPTS.md`	4 named, versioned prompts loaded by `agent.py`
`CHECKLIST.md`	20+ deploy/operate steps with command snippets
`SPEC.md`	Technical spec, configurable parameters, interfaces
`CUSTOMIZE.md`	Where to plug in your own SBOM / license data / policy
`OPERATING_COST_ESTIMATE.md`	Provider-agnostic cost method
`agent.py`	Runnable agent (deterministic core + BYO-LLM)
`llm_adapter.py`	BYO-LLM CLI adapter (claude/kimi/codex, no API key)
`data/known_licenses.json`	Seed package → SPDX license map (extend it)
`data/license_categories.json`	SPDX → category + copyleft flag
`data/policy.json`	Category → verdict (allow/warn/deny)
`data/requirements.txt`	Sample Python manifest (demo + smoke test)
`data/package.json`	Sample npm manifest (demo + smoke test)
`install.sh` / `deploy.sh`	One-shot Debian installer + systemd unit
`test_agent.py` / `smoke_test.sh`	Offline test suite (no keys)

Quick-start

# 1) Install (Debian/Ubuntu VM): system deps + venv + optional systemd service
sudo bash install.sh
#    venv only, run by hand:  bash install.sh --no-service

# 2) Audit your own manifest
python3 agent.py audit --manifest /path/to/requirements.txt

# 3) Gate CI (non-zero exit if any denied license is present)
python3 agent.py audit --manifest package.json --strict || echo "license gate failed"

# 4) Explain a risky package and get a permissive alternative
python3 agent.py explain --package mysql-connector-python

No API key is required. If a Claude Code / Kimi Code / Codex CLI is logged in, the agent uses it to enrich explanations; otherwise it runs a fully deterministic core.

Deterministic first, smart if connected

The verdict is always computed by deterministic rules over your policy — the LLM never overrides a policy decision. It only explains risk and suggests alternatives when a CLI is available. That keeps audits reproducible and auditable.

License

Personal use per purchase. Resale prohibited.

Agent License Audit Pack v1.0

What's inside