Dependencies: licenses, advisories and SBOM for a GitHub repo

Check a repo's dependency licenses, then hand the report to your AI

Reads the repo's npm, Python, Go and Rust dependencies (package.json, requirements, pyproject.toml, Pipfile, go.mod, Cargo.toml, and their lockfiles for exact versions), looks up each package's license and known advisories on deps.dev, and groups them for review. Runs in your browser. Package names and versions are sent to deps.dev; nothing else is.

What this does and doesn't check

Supported: npm (package.json; package-lock, yarn and pnpm lockfiles), Python (requirements*.txt, pyproject.toml, Pipfile; poetry.lock, uv.lock, Pipfile.lock), Go (go.mod) and Rust (Cargo.toml, Cargo.lock).
Not supported yet: Maven, Gradle, Ruby, PHP, .NET, Swift, Dart and others. If the repo has their manifests, the report says so and is incomplete.
Never seen: code copied into the repo, git submodules, system or container packages, and scripts loaded from a CDN.
Advisories: only those known to deps.dev. No advisory doesn't mean no vulnerability, and internal or private packages have no data.
Licenses: from registry metadata, which can differ from a package's own license file. Groups and policies guide review; they are not legal advice.
Versions: exact when a lockfile is present; otherwise estimated from the manifest's ranges. Go's indirect modules come from go.mod and have no "via" path; Cargo.lock doesn't mark dev-only crates.

Public repos work without a token. For a private repo, (kept only in this tab, never saved) or use Open .zip. A .zip is read locally and never uploaded.

Try:

GitHub repository

Compare with (optional)

Enter a repo as owner/name or a GitHub URL.

Send to:

Add a GitHub token

Include transitive dependencies Include development and test dependencies

Skip example, test and docs folders List permissive packages briefly (saves tokens)

License policy

Permissive Weak copyleft Strong copyleft Restricted Unknown

Always block these licenses (SPDX IDs, comma-separated) Always allow these licenses Approved packages (name or ecosystem:name)

Applies your team's rules to the license groups. It is not legal advice.

Instructions for the AI (optional) 0 chars

Packages

Load a repository to list its dependencies and their licenses.

Output

The report appears here once dependencies are loaded.

Ready Report a problem