Which SBOM formats are supported?

The auditor supports SPDX 2.3 and CycloneDX 1.5. It accepts SPDX JSON, CycloneDX JSON, and CycloneDX XML input.

Can I let the tool detect the SBOM format?

Yes. Set SBOM Format to Auto detect, or select SPDX 2.3 or CycloneDX 1.5 explicitly.

How can I block specific licenses?

Enter license identifiers in the Denied Licenses field, separated by commas or new lines.

What happens when a license is unknown?

Enable Fail on unknown licenses to treat unknown licenses as policy failures.

What report formats are available?

The auditor outputs either SARIF 2.1.0 or Markdown.

Elysia Tools

Navigation

Development

SBOM SPDX CycloneDX License Policy Auditor

Audit SPDX 2.3 or CycloneDX 1.5 component licenses and emit SARIF with failing dependency paths

Details

What this tool helps you do

Classifies permissive, weak/strong/network copyleft, source-available, proprietary, and unknown licenses; applies allow/deny lists and policy presets; and traces every failing component back to a dependency root.

Execution

Run this tool

Fill in the form, run the tool, and review the result in one place.

Prepared example runs

Click an example to fill the form automatically. File inputs still need an upload.

1 examples

Block AGPL in a CI license gate

Audit an SPDX dependency tree and emit SARIF that points from the application root to the denied package.

SARIF 2.1.0 license policy report

Inputs

Options are grouped so long tools stay easier to scan.

9 options

FilesUpload source files for this workflow.1

SBOM FilefileOptional

Single file max size: 10 MBSupported types: application/json, application/xml, text/xml, text/plain

ContentPaste or type the main input values.3

SBOM InputtextareaOptionalAllowed LicensestextareaOptionalDenied LicensestextareaOptional

SettingsAdjust formats, ranges, numbers, and modes.4

SBOM FormatselectOptionalPolicy PresetselectOptionalCopyleft ToleranceselectOptionalReport FormatselectOptional

TogglesEnable or disable optional behavior.1

Fail on unknown licensescheckboxOptionalEnabled when checked

Result

Ready for a run

Run the tool to preview files, text, structured data, or streamed output here.

Samples

SBOM SPDX CycloneDX License Policy Auditor

What this tool helps you do

Run this tool

Prepared example runs

Inputs

Result

Examples that match this tool

Continue with connected tools and hubs

Prepared example runs

Inputs

Result

Learn when to use this tool, what it supports, and how real users apply it.

Key facts

Overview

When to use

How it works

Use cases

Examples

1. Block AGPL in a CI license gate

2. Review an SBOM with a strict license policy

FAQ

Android Serialization Java Samples

Android Serialization Kotlin Samples

macOS Serialization Objective-C Samples

Web Data Serialization Go Samples

Time Series Anomaly Detector

Data URI Generator

XLSX Formula Injector

JSON-LD Generator from CSV

JSON Interchange and Format Translation Tools

Text Case, Encoding, and Normalization Conversion Tools

JSON Inspection, Diff, and Transformation Tools

Text Tools