Assess open source licence obligations and compliance risk across dependencies.
Copyleft obligations largely depend on whether software is distributed, which is why SaaS carries lower risk than shipping binaries. AGPL is the notable exception because network use counts as distribution. Unknown or unlicensed dependencies are the highest risk of all, because absence of a licence means no permission to use the code rather than permissive terms.
License Compliance
Risk = strong copyleft × 12 + weak copyleft × 3, scaled by distribution model, plus unknowns × 8
This is a screening heuristic and not legal advice. Open source licence obligations depend on the specific licence text, how the code is linked and how the software is distributed. Obtain qualified legal review before relying on any assessment.
Risk = strong copyleft × 12 + weak copyleft × 3, scaled by distribution model, plus unknowns × 8 Copyleft obligations largely depend on whether software is distributed, which is why SaaS carries lower risk than shipping binaries. AGPL is the notable exception because network use counts as distribution.
Unknown or unlicensed dependencies are the highest risk of all, because absence of a licence means no permission to use the code rather than permissive terms.
This calculator takes 5 inputs: Permissive licences, MIT or Apache, Weak copyleft, LGPL or MPL, Strong copyleft, GPL or AGPL, Unknown or unlicensed, Distribution model. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.