Useful Commons

Free browser tool

Inventory dependencies and licenses

Paste a lockfile to list every component and exact version, check licenses against your own allow list, link advisories only on exact matches, and assemble NOTICE text from records you approved.

Runs on this device. No upload, account or tracking; nothing is scheduled or applied.

Your lockfile

requirements.txt, package-lock.json or a CycloneDX SBOM
    Empty
    Empty

    License policy

    Empty

    For example {"label": "default", "version": "1", "allowed_licenses": ["MIT", "Apache-2.0"], "denied_licenses": ["AGPL-3.0-only"]}

    Evidence you supply optional

    Empty

    [{"name", "version", "ecosystem", "license", "evidence"}]. Without a record, a license stays unresolved.

    Empty

    {"source", "report_date": "YYYY-MM-DD", "items": [{"id", "package", "ecosystem", "affected_versions" or "ranges"}]}. Only exact matches are linked.

    Empty

    {"digest": "sha256:…", "format": "package-list", "content": "deb openssl 3.0.13"}

    Empty

    [{"label", "name", "version", "source", "license", "provenance_evidence"}]

    Empty

    [{"name", "version", "license", "notice_text", "approved": true}]. Only approved records enter the NOTICE text.

    Lockfiles up to 400,000 characters and 10,000 components. Licenses are never guessed, and this is not legal advice or proof of exploitability.

    About this tool

    What this tool does

    Turn a requirements.txt, package-lock.json or CycloneDX SBOM into an exact dependency inventory with unresolved license, policy and advisory findings.

    Limits and safe use

    Lockfiles up to 400,000 characters and 10,000 components. Licenses are never guessed, and this is not legal advice or proof of exploitability. Review the report before relying on it. It is a deterministic check, not a certification, and it does not send data to a server or a model.