Segrep

segrep-license scanner

Opt-in license compliance scanner with SPDX risk classification

Opt-in license compliance scanner for Segrep that classifies dependency licenses by risk and flags copyleft or unknown licenses in your project.

Why use segrep-license

  • Detects copyleft and unknown licenses in your dependency tree before they reach production.
  • Classifies every SPDX license into risk tiers: permissive (low), weak-copyleft (medium), strong-copyleft (high), unknown (medium).
  • Supports MIT OR Apache-2.0 dual-license expressions and { "type": "MIT" } object formats.
  • Runs locally with no external API calls — fast, offline, and CI-friendly.

Scanner behavior

segrep-license runs as an opt-in scanner.

pnpm segrep scan . --scanners segrep-license

It scans:

  • Root package.json license field
  • All node_modules/*/package.json license fields
  • Scoped packages under node_modules/@scope/*/package.json

License classification

RiskSeverityExamples
PermissivelowMIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, CC0-1.0, Unlicense
Weak copyleftmediumLGPL-2.1, LGPL-3.0, MPL-2.0, EPL-1.0, EPL-2.0, CDDL-1.0
Strong copylefthighGPL-2.0, GPL-3.0, AGPL-3.0, EUPL-1.2, SSPL-1.0
UnknownmediumAny SPDX ID not in the classification database

When a package uses a dual license expression (e.g., MIT OR Apache-2.0), the scanner picks the worst-case license for severity classification.

Finding output

Each finding includes:

  • packageName and installedVersion from the package manifest
  • ruleId set to the classified SPDX license identifier
  • category set to license
  • snippet containing the raw license string from the manifest

Example finding:

{
  "id": "segrep-license:lodash@4.17.21:MIT",
  "title": "Permissive license detected in lodash@4.17.21",
  "severity": "low",
  "packageName": "lodash",
  "installedVersion": "4.17.21",
  "ruleId": "MIT",
  "category": "license",
  "snippet": "MIT"
}

Policy integration

Use .segrep/policy.yml to control license scanner behavior:

scanners:
  - segrep-license

# Allowlist known-good licenses by SPDX ID
allowlist:
  - MIT
  - Apache-2.0

# Ignore paths that are not shipped to production
ignore_paths:
  - "**/*.test.ts"
  - "fixtures/**"

Examples

Scan only for license compliance:

docker run --rm -v "$(pwd):/repo:ro" security-scanner:local \
  scan /repo --scanners segrep-license

Combine with dependency vulnerability scanning:

docker run --rm -v "$(pwd):/repo:ro" security-scanner:local \
  scan /repo --scanners segrep-vuln,segrep-license --format json

Fail CI on any strong copyleft license (high severity):

docker run --rm -v "$(pwd):/repo:ro" security-scanner:local \
  scan /repo --scanners segrep-license --fail-on high

Limitations

  • Only scans npm ecosystem packages (package.json manifests).
  • Does not scan go.mod, Cargo.lock, Gemfile.lock, or other non-npm ecosystems.
  • License classification is based on a curated SPDX database; unknown licenses are flagged as medium severity rather than silently ignored.

Related docs