Offline dependency license audit for npm and Python

What it does

Lists a repository's dependencies and their declared licenses using only local files, with no network access.

• Reads package.json, package-lock.json (v1 to v3), npm-shrinkwrap.json, yarn.lock (v1), requirements*.txt, pyproject.toml (PEP 621 and Poetry), poetry.lock, uv.lock and Pipfile.lock
• License sources: each package's package.json in node_modules, the lockfile license field, METADATA in site-packages (License-Expression, License, classifiers) and bundled LICENSE files
• Finds virtualenvs inside the repository (such as .venv) automatically
• Classifies each license as permissive, weak copyleft (LGPL, MPL), strong copyleft (GPL), network copyleft (AGPL), restricted or unknown
• Writes licenses.json, licenses.csv (opens in Excel) and report.md; for CI it can exit with code 1 when chosen levels are present

How to use

python scripts/license_audit.py . --out ./license-audit
python scripts/license_audit.py . --no-dev --fail-on strong-copyleft,network-copyleft,unknown

The agent then verifies each flagged package and reports with evidence.

Requirements

• Python 3.11+ (standard library only; on 3.10 and older, TOML files are skipped)
• For accurate results, dependencies should be installed (npm ci, or pip install into a virtualenv)

Caveats

• This is not legal advice; get professional review for decisions.
• Packages that are not installed show as unknown.
• Python projects without a lockfile only list direct dependencies.
• pnpm-lock.yaml is not parsed (only direct dependencies from package.json are listed).
• It reads declared licenses only and does not inspect source files.