--- title: "List the licences of the code and every ยท Agent Wranglers" url: https://agentwranglers.se/playbook/due-diligence/code-and-ownership/licence-inventory id: TDD-6 level: Recommended updated: 2026-10-27 build: a2a6bdfed830 tokens: 956 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # List the licences of the code and every dependency For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Code and ownership](https://agentwranglers.se/playbook/due-diligence/code-and-ownership.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. - ID: TDD-6 - Level: Recommended - Chapter: [Code and ownership](https://agentwranglers.se/playbook/due-diligence/code-and-ownership.md) - Rule: Produce a bill of materials with an SPDX licence identifier for every package, and assess each copyleft, unknown or missing licence in writing. - Check: The bill of materials, in SPDX or CycloneDX format, gives a licence for every package. Every copyleft, unknown or missing licence has a written assessment in the report. - How: A strong copyleft licence such as the GPL or AGPL can oblige the company to publish its own code. It depends on how the product is shipped or served. A package with no licence gives no right to use it at all. Generate the list with an SBOM tool, as [Publish what is in each release](https://agentwranglers.se/playbook/application-security/supply-chain/sbom-and-provenance.md) says. The Trivy setup in [Use cosign to sign release images and their bill of materials](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/sbom-and-signing.md) already writes one. Generated code can copy licensed code, so check [Check where generated code came from](https://agentwranglers.se/playbook/ai-assisted-development/reviewing-agent-output/code-provenance.md) too. A lawyer judges the findings. The review lists them. ## Sources - [SPDX License List](https://spdx.org/licenses/) - [OSI approved licenses](https://opensource.org/licenses) ## Related rules - OSS-2 [Writing your own licence or changing a standard one](https://agentwranglers.se/playbook/open-source/licences-and-copyright/no-custom-licence.md) in Open source maintenance - OSS-4 [Declare the licence in the package metadata](https://agentwranglers.se/playbook/open-source/licences-and-copyright/licence-in-package-metadata.md) in Open source maintenance - OSS-42 [Check every dependency licence against an allow list in CI](https://agentwranglers.se/playbook/open-source/using-open-source/dependency-licence-policy.md) in Open source maintenance - TDD-5 [Confirm the company owns the code](https://agentwranglers.se/playbook/due-diligence/code-and-ownership/code-ownership-rights.md) in Technical due diligence - APS-75 [Publish what is in each release](https://agentwranglers.se/playbook/application-security/supply-chain/sbom-and-provenance.md) in Application security - STK-95 [Use cosign to sign release images and their bill of materials](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/sbom-and-signing.md) in Software choices - AID-21 [Check where generated code came from](https://agentwranglers.se/playbook/ai-assisted-development/reviewing-agent-output/code-provenance.md) in AI-assisted development **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers technical due diligence playbook`. In code you write, add a comment next to it with the same link. - Previous: [Confirm the company owns the code](https://agentwranglers.se/playbook/due-diligence/code-and-ownership/code-ownership-rights.md) - Next: [Scan the whole history for secrets](https://agentwranglers.se/playbook/due-diligence/code-and-ownership/history-secret-scan.md) - [Code and ownership](https://agentwranglers.se/playbook/due-diligence/code-and-ownership.md)