# SBOM SPDX CycloneDX License Policy Auditor

Audit SPDX 2.3 or CycloneDX 1.5 component licenses and emit SARIF with failing dependency paths

> Canonical page: https://elysiatools.com/en/tools/sbom-spdx-cyclonedx-license-policy-auditor

- **Category:** Development

- **Keywords:** SBOM, SPDX, CycloneDX, license compliance, SARIF, copyleft, dependency path, DevSecOps

## Overview

Classifies permissive, weak/strong/network copyleft, source-available, proprietary, and unknown licenses; applies allow/deny lists and policy presets; and traces every failing component back to a dependency root.

## Inputs

- **SBOM Input** (textarea): Paste SPDX JSON or CycloneDX JSON/XML
- **SBOM File** (file)
- **SBOM Format** (select)
- **Policy Preset** (select)
- **Copyleft Tolerance** (select)
- **Allowed Licenses** (textarea): Optional comma/newline list, e.g. MIT, Apache-2.0
- **Denied Licenses** (textarea): Optional comma/newline list, e.g. AGPL-3.0-only, BUSL-1.1
- **Fail on unknown licenses** (checkbox)
- **Report Format** (select)

## When to use

- Check dependency licenses before a release or software distribution.
- Enforce copyleft, proprietary, source-available, or unknown-license policies in DevSecOps reviews.
- Trace a failing component from the application root through its dependency path.

## How it works

- Paste an SPDX JSON or CycloneDX JSON/XML SBOM, or provide a supported SBOM file.
- Choose automatic format detection or select SPDX 2.3 or CycloneDX 1.5.
- Set a policy preset, copyleft tolerance, optional allowed and denied license lists, and unknown-license handling.
- Generate a SARIF 2.1.0 or Markdown report containing policy failures and dependency paths.

## Use cases

- Gate builds that introduce denied licenses such as AGPL-3.0-only.
- Review third-party dependency trees against permissive, balanced, or strict policy presets.
- Produce a focused compliance report showing each failing component and its path to a dependency root.

## Frequently asked questions

### Which SBOM formats are supported?

The auditor supports SPDX 2.3 and CycloneDX 1.5. It accepts SPDX JSON, CycloneDX JSON, and CycloneDX XML input.

### Can I let the tool detect the SBOM format?

Yes. Set SBOM Format to Auto detect, or select SPDX 2.3 or CycloneDX 1.5 explicitly.

### How can I block specific licenses?

Enter license identifiers in the Denied Licenses field, separated by commas or new lines.

### What happens when a license is unknown?

Enable Fail on unknown licenses to treat unknown licenses as policy failures.

### What report formats are available?

The auditor outputs either SARIF 2.1.0 or Markdown.

## Related tools

- [Time Series Anomaly Detector](https://elysiatools.com/en/tools/time-series-anomaly-detector): Upload CSV or JSON time series data, detect anomalies with Z-Score and IQR methods, and return a chart-backed report
- [Data URI Generator](https://elysiatools.com/en/tools/data-uri-generator): Convert files into Data URIs (Base64 or percent-encoded) for inlining images, fonts, and assets directly into HTML, CSS, or Markdown
- [XLSX Formula Injector](https://elysiatools.com/en/tools/xlsx-formula-injector): Fill formulas down worksheet columns and optionally lock formula cells for protected, template-friendly Excel workbooks
- [JSON-LD Generator from CSV](https://elysiatools.com/en/tools/json-ld-generator-from-csv): Turn CSV or Excel rows into Schema.org JSON-LD for articles, products, or events, with validation-ready output for SEO workflows
- [Time Series Forecast & Seasonality Analyzer](https://elysiatools.com/en/tools/time-series-forecast-seasonality-analyzer): Forecast future periods from CSV or JSON time-series data and inspect trend, seasonal, and residual decomposition in one report
- [XLSX Column Mapper](https://elysiatools.com/en/tools/xlsx-column-mapper): Rename, reorder, and drop Excel columns with alias matching and case/whitespace normalization
- [JSON Path Visualizer](https://elysiatools.com/en/tools/json-path-visualizer): Visualize JSON or JSONL as an expandable tree and copy JSONPath expressions for every node
- [Log Sequence Diagram Converter](https://elysiatools.com/en/tools/log-sequence-diagram-converter): Convert structured service logs into Mermaid or PlantUML sequence diagrams, with optional latency and error annotations

## Samples

- [Android Serialization Java Samples](https://elysiatools.com/en/samples/android-serialization-java): Android Java serialization examples including JSON serialization, deserialization, and XML parsing
- [Android Serialization Kotlin Samples](https://elysiatools.com/en/samples/android-serialization-kotlin): Android Kotlin serialization examples including JSON serialization, deserialization, and XML parsing
- [macOS Serialization Objective-C Samples](https://elysiatools.com/en/samples/macos-serialization-objectivec): macOS Objective-C serialization examples including JSON serialization, JSON deserialization, and XML parsing
- [Web Data Serialization Go Samples](https://elysiatools.com/en/samples/web-serialization-go): Web Go data serialization examples including JSON encoding/decoding and XML parsing