How licenseproof resolves dependency licenses

licenseproof reads only files already present on disk from your scanned project and its installed dependencies. It never contacts a network, registry, or remote service. The two ecosystems it supports use different resolution orders, described in full below.

npm packages

The first step that yields a license wins. Later steps are not consulted once one succeeds.

Declared metadata. The license field in the package's package.json, parsed as an SPDX id or expression (OR, AND, and WITH clauses are all preserved). Confidence: high. npm's UNLICENSED convention is not treated as an SPDX id, and falls through to the next step.
License file. The text of an on-disk LICENSE or COPYING file, matched by fingerprint against known license texts. Confidence: medium for a close match, low for a modified or partial one.
README mention. A License: line near the top of the README. Confidence: low.
Unknown. No signal resolved. The package is reported as UNKNOWN and flagged for review. Unknown does not mean safe.

PyPI packages

Metadata signals are read together, so a disagreement between them can be surfaced. The on-disk steps only run when no metadata signal resolved.

License-Expression. The PEP 639 License-Expression metadata field. Confidence: high.
License. The legacy License metadata field, used when no License-Expression is present. Confidence: high.
Trove classifiers. The License :: classifiers, mapped to a representative SPDX id. Confidence: medium, since classifiers are coarser than an explicit id (for example, "BSD License" cannot distinguish BSD-2 from BSD-3).
License file. On-disk license text, fingerprint-matched. Confidence: medium or low, same as npm.
README mention. A License: line. Confidence: low.
Unknown. Reported as UNKNOWN, flagged for review.

When a PyPI package's declared license field and its Trove classifiers resolve to different licenses, and not merely to different variants of the same license family, the package is additionally flagged for review as an internal metadata inconsistency.

What the confidence levels mean

high. The license came from an explicit, declared SPDX id or expression in package or project metadata.
medium. The license was inferred from a close license-file text match, or from a coarse Trove classifier.
low. The license came from a modified or partial license-file match, a README mention, or could not be determined at all (Unknown).

Limitations

The category assigned to each license is an informational classification, not a legal determination of your obligations.
Only declared and detectable license signals are used. No manual legal review is performed, and no upstream registry is consulted since the tool runs fully offline.
Dependency paths are enumerated up to a cap. A note like "at least N other paths" is a floor, not an exact total.
A package's resolved license reflects the metadata and files present on disk at scan time. It is not verified against any external source of truth.
Unknown does not mean safe. It means the license could not be identified confidently and needs a human to look.

Not legal advice

This is an informational license categorization produced by automated analysis of declared package metadata and license files. It is not legal advice and is not a substitute for review by qualified counsel.

See pricing and get the report tier