Agent OS · Component · dependency-license-audit
Dependency license policy and metadata audit
What it does
Compare npm lockfile v3 dependency metadata with installed package metadata, classify allow/review/forbidden licenses and apply exact package/version/scope exceptions.
Core pattern
Dependency metadata comparison + license rule review
- Input
- Lockfile, installed package root and policy sets
- Output
- Dependency classifications, metadata mismatches and review/block report
Key parameters
| Name | Type | Default | Values |
|---|---|---|---|
| operation | string | audit | audit · classify |
| lockfile | string | — | — |
| source_root | string | — | — |
| license_policy | object | — | — |
| format | string | json | json · csv · markdown · html · pdf · xlsx · pptx · png · svg · text |
Maturity and limits
auditLicenses checks lockfileVersion=3, package version/license mismatches, optional dependencies and reviewed exceptions. classifyLicense tokenizes SPDX-like expressions conservatively. Source inspected statically; tests and external integrations were not executed.
Not legal advice or a full SPDX expression evaluator; OR/WITH are conservatively tokenized. Policy sets and exceptions are source constants today.
1 sentence citing source paths or vendor names omitted for publication.
Used in pipelines
Industry tags
- EnergyTransferable use
For offline delivery and recovery preparation for site operations software, use dependency metadata comparison followed by license rule review.
- Business & general servicesTransferable use
Support “Check tool provenance and licenses” with dependency metadata comparison followed by license rule review.
Skills pack
Contract scaffold and deterministic mock
Download · 11KBSHA-256 31985ff40ca8d7ea56f21403d8231e4fec6dd082b622ec794252feacd5313ad7
Related components
-
Local coding-agent execution governance
Pre-action policy decisions + human permission and audit
Working 1 pipeline -
Collaborative delivery, approvals and evidence gates
Draft and artifact versioning + human handoff approval
Working 4 pipelines -
Tenant identity, enterprise SSO, provisioning and access control
Organization membership sync + scoped role access
Working 1 pipeline -
Signed plugin registry and trusted installation
Signed extension registry + installation verification and revocation
Working 1 pipeline