---
title: "List the licences of the code and every · Agent Wranglers"
url: https://agentwranglers.se/playbook/codebase-takeover/due-diligence/licence-inventory
id: TKO-29
level: Recommended
updated: 2026-10-22
tokens: 690
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# List the licences of the code and every dependency

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Due diligence](https://agentwranglers.se/playbook/codebase-takeover/due-diligence.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: TKO-29
- Level: Recommended
- Chapter: [Due diligence](https://agentwranglers.se/playbook/codebase-takeover/due-diligence.md)
- Rule: Produce a bill of materials with an SPDX licence identifier for every package, and assess each copyleft, unknown or missing licence in writing.
- Check: The bill of materials, in SPDX or CycloneDX format, gives a licence for every package. Every copyleft, unknown or missing licence has a written assessment in the report.
- How: A strong copyleft licence such as the GPL or AGPL can oblige the company to publish its own code. It depends on how the product is shipped or served. A package with no licence gives no right to use it at all. Generate the list with an SBOM tool, as [Publish what is in each release](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/sbom-and-provenance.md) says. Generated code can copy licensed code, so check [Check where generated code came from](https://agentwranglers.se/playbook/ai-assisted-development/reviewing-agent-output/code-provenance.md) too. A lawyer judges the findings. The review lists them.

## Sources

- [SPDX License List](https://spdx.org/licenses/)
- [OSI approved licenses](https://opensource.org/licenses)

## Related rules

- SEC-74 [Publish what is in each release](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/sbom-and-provenance.md) in Adversarial testing
- AID-21 [Check where generated code came from](https://agentwranglers.se/playbook/ai-assisted-development/reviewing-agent-output/code-provenance.md) in AI-assisted development

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/codebase-takeover/due-diligence/licence-inventory">Agent Wranglers codebase takeover playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Find every part that depends on one person or one tool](https://agentwranglers.se/playbook/codebase-takeover/due-diligence/single-points-of-failure.md)
- Next: [Ask the team to explain the critical paths without AI](https://agentwranglers.se/playbook/codebase-takeover/due-diligence/explain-without-ai.md)
- [Due diligence](https://agentwranglers.se/playbook/codebase-takeover/due-diligence.md)