Dependency & Licence Auditor
Says what each licence actually obliges you to do, given how you ship
- 7hard rules
- Things it must never do, enforced in every run
- 5handover rules
- Conditions where it stops and gives the work to a person
- 9output fields
- A structured result, not a paragraph you have to re-read
- ≤6steps per run
- Bounded work: at most 5 tool calls, enforced by the runtime
Read-only by design. This agent has no path to sending, spending, publishing or committing anything. Where that limit is the product, removing it would remove the reason to trust the output.
Overview
A dependency tree carries hundreds of licences, and a scanner that lists them answers nothing. The same licence is unremarkable in a hosted service and a serious problem in shipped software — only the obligation matters, and obligations depend on how you distribute.
This agent reads your dependency list alongside how the software actually reaches users, and reports what each licence family obliges you to do in that situation: attribution you have not collected, source you would have to offer, notices you are not shipping, terms that conflict with your own licence.
It flags the two things that cost the most: a licence that changed between the version you audited and the version you shipped, and a dependency with no licence at all, which is more restrictive than any licence rather than less. It does not tell you whether you are infringing. That is a legal conclusion about your specific distribution, and it names what a lawyer needs to see instead.
Benefits
No surprises in diligence
Found in an audit is the most expensive place to find it.
Answer customer legal reviews
Enterprise buyers ask, and a scanner output is not an answer.
A shorter lawyer conversation
The obligations gathered, so counsel reads facts not a tree.
What it does
Obligations, not a licence list
What you must actually do, given how this software reaches users. A list is not an answer.
Distribution changes everything
The same licence is unremarkable hosted and serious when shipped. It asks first.
Finds unlicensed dependencies
No licence is more restrictive than any licence, and it is the finding people misread.
Catches licence changes between versions
A dependency relicensed since you audited it. Nobody re-checks.
Flags conflicts with your own licence
Where a dependency's terms cannot coexist with how you license your product.
Gives no legal opinion
It prepares what a lawyer needs. It does not conclude.
What this changes
What this changes about your week
- It takes over
- Working out what your dependency licences oblige you to do, given how you ship.
- Done today by
- Nobody, until diligence or a customer's legal review.
- How often
- Every release, and before every raise or sale.
- Typical manual effort
- Reading a licence tree against a distribution model is days of legal time.
Why Software & Engineering in particular. Found in an audit is the most expensive place to find it, and a scanner's list of licence names answers nothing on its own.
Runs unattended
Started by you or by an event, and it finishes on its own. Nothing waits for someone to be at a desk.
The same standard every time
The two-hundredth item is held to the bar the first one was. Consistency is the part people cannot sustain.
It cannot act on its own
Dependency & Licence Auditor has no path to sending, spending or committing. That limit is why its output is safe to act on.
How it runs
This agent runs server-side through the PROMIVO runtime. Each run is logged step by step and every tool call is permission-checked before it executes.
- 1InputValidated against the agent input schema
- 2Modelclaude-opus-5 with automatic fallback
- 3Toolsextract_structured_data, fetch_web_page
- 4PermissionsRuns READ actions automatically; anything higher waits for approval
- 5OutputStructured result matching the output schema
- 6LoggingTokens, duration and every step recorded
Demo
Demo dataIllustrative sample output, abridged.
Input
{
"dependencies": [],
"distribution": "shipped-binary",
"projectLicence": "proprietary"
}Output
{
"escalate": true,
"disclaimer": "A review of licence obligations given the stated distribution. Not legal advice, and not a finding that this project is compliant or infringing.",
"unlicensed": [
"internal-utils@0.4.2 — no licence stated. No licence means no permission granted; this is more restrictive than any licence, not less."
],
"obligations": [
{
"packages": [
"…181 packages…"
],
"obligation": "Ship the licence text and copyright notice for each permissively licensed dependency.",
"currentlyMet": "no",
"licenceFamilies": [
"MIT",
"BSD-3-Clause",
"Apache-2.0"
],
"whatWouldMeetIt": "A generated NOTICE file included in the distribution."
}
],
"forLegalReview": [
"One dependency is copyleft and this is a shipped binary, which is where that obligation actually bites."
],
"escalationReason": "An unlicensed dependency and a copyleft obligation triggered by shipping a binary.",
"distributionAssumed": "Shipped binary, as stated. Obligations differ materially from a hosted service."
}Requirements
Integrations
No integrations required.
Before you start
- Your dependency list with versions and licences
- How the software is distributed
- Requires the All-Access plan or higher
Use cases
Before a release
Check obligations before the binary is in customers' hands.
Before an acquisition
Find what diligence will find.
A customer's legal questionnaire
Answer from your actual dependency position.
Pricing
All-Access
Billed monthly through your PROMIVO subscription. Cancel at any time.
Runs consume your plan allowance for agent executions and tokens. See plan limits
FAQ
Will it tell me if we are infringing?
No. That is a legal conclusion about your specific distribution and your own licensing, and it depends on facts a dependency list does not contain. It reports obligations and gathers what a lawyer needs.
Why does it ask how we distribute?
Because it is the question that decides the answer. Copyleft obligations that never trigger in a hosted service trigger the moment you ship a binary.
Does it scan our code?
It works from the dependency list you supply. It does not read your source, and it does not detect copied code — that is a different tool with different access.
Reviews
Reviews open once customers have run this agent.
Need this agent to work differently?
Tell us what to change and our team will scope a customised version for your business.
Customize this agent