Says what each licence actually obliges you to do, given how you ship
A dependency tree carries hundreds of licences, and a scanner that lists them answers nothing. The same licence is unremarkable in a hosted service and a serious problem in shipped software — only the obligation matters, and obligations depend on how you distribute.
This agent reads your dependency list alongside how the software actually reaches users, and reports what each licence family obliges you to do in that situation: attribution you have not collected, source you would have to offer, notices you are not shipping, terms that conflict with your own licence.
It flags the two things that cost the most: a licence that changed between the version you audited and the version you shipped, and a dependency with no licence at all, which is more restrictive than any licence rather than less. It does not tell you whether you are infringing. That is a legal conclusion about your specific distribution, and it names what a lawyer needs to see instead.
Found in an audit is the most expensive place to find it.
Enterprise buyers ask, and a scanner output is not an answer.
The obligations gathered, so counsel reads facts not a tree.
What you must actually do, given how this software reaches users. A list is not an answer.
The same licence is unremarkable hosted and serious when shipped. It asks first.
No licence is more restrictive than any licence, and it is the finding people misread.
A dependency relicensed since you audited it. Nobody re-checks.
Where a dependency's terms cannot coexist with how you license your product.
It prepares what a lawyer needs. It does not conclude.
This agent runs server-side through the PROMIVO runtime. Each run is logged step by step and every tool call is permission-checked before it executes.
Demo dataIllustrative sample output, abridged.
{
"dependencies": [],
"distribution": "shipped-binary",
"projectLicence": "proprietary"
}{
"escalate": true,
"disclaimer": "A review of licence obligations given the stated distribution. Not legal advice, and not a finding that this project is compliant or infringing.",
"unlicensed": [
"internal-utils@0.4.2 — no licence stated. No licence means no permission granted; this is more restrictive than any licence, not less."
],
"obligations": [
{
"packages": [
"…181 packages…"
],
"obligation": "Ship the licence text and copyright notice for each permissively licensed dependency.",
"currentlyMet": "no",
"licenceFamilies": [
"MIT",
"BSD-3-Clause",
"Apache-2.0"
],
"whatWouldMeetIt": "A generated NOTICE file included in the distribution."
}
],
"forLegalReview": [
"One dependency is copyleft and this is a shipped binary, which is where that obligation actually bites."
],
"escalationReason": "An unlicensed dependency and a copyleft obligation triggered by shipping a binary.",
"distributionAssumed": "Shipped binary, as stated. Obligations differ materially from a hosted service."
}No integrations required.
Check obligations before the binary is in customers' hands.
Find what diligence will find.
Answer from your actual dependency position.
$199/month
Billed monthly through your PROMIVO subscription. Cancel at any time.
Runs consume your plan allowance for agent executions and tokens. See plan limits.
No. That is a legal conclusion about your specific distribution and your own licensing, and it depends on facts a dependency list does not contain. It reports obligations and gathers what a lawyer needs.
Because it is the question that decides the answer. Copyleft obligations that never trigger in a hosted service trigger the moment you ship a binary.
It works from the dependency list you supply. It does not read your source, and it does not detect copied code — that is a different tool with different access.
No reviews yet. Reviews open once customers have run this agent.
Tell us what to change and our team will scope a customised version for your business.
Customize this agent