Integrate LicenseFinder with Vulnetix. Run LicenseFinder against your project to detect dependency licences, export as JSON or CSV, and upload to Vulnetix for licence risk tracking.
Install & scan
$ gem install license_finder # Or add to Gemfile (recommended for projects) bundle add license_finder --dev $ license_finder report --format json > license-report.json
Run LicenseFinder in CI
Scan on every push and upload the report as a workflow artifact:
- name: Install LicenseFinder run: gem install license_finder - name: Install project dependencies run: npm install # or bundle install / pip install -r requirements.txt - name: Run LicenseFinder run: license_finder report --format json > license-report.json - name: Upload to Vulnetix run: vulnetix upload --file license-report.json
How Vulnetix compares: better together
Vulnetix does not replace LicenseFinder. Keep running it. Vulnetix sits on top of LicenseFinder (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
LicenseFinder is strongest at its core category and also carries features in SCA, SBOM Generation, just as Vulnetix spans categories.
| Capability | Vulnetix | LicenseFinder |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✗ |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ~ Discovers full dependency sets (including transitive) across 28+ package managers, but for license not vuln analysis |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✗ |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✗ |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✗ |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✗ |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✗ |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✓ Core: detects dependency licenses and enforces a user-defined permitted/prohibited license policy |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ~ Emits dependency+license reports (text/CSV/HTML/markdown); no standard CycloneDX/SPDX SBOM output |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✗ |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ✗ |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What LicenseFinder does well
- Works directly with 28+ package managers across Ruby, Python, JavaScript, Java, Go, PHP, Rust, Scala, Elixir, Swift and more to discover dependencies and their licenses
- Policy governance built in: permitted/prohibited license lists, per-package approvals with approver notes, and inheritable centralized decision files
- Handles unknown licenses via manual CLI assignment and reads metadata, README and license-text files for detection
- Multiple report formats (text, CSV, HTML, markdown) suited to CI license-compliance gating
Where Vulnetix adds to it: LicenseFinder is a focused license-compliance CLI with no vulnerability, container, IaC, secrets or malware scanning. Vulnetix runs those engines natively across 40+ ecosystems and layers cross-scanner dedup, exploit-intel prioritization, reachability, versioned VEX, autofix, EOL and SSVC, while also producing standard CycloneDX 1.7 + SPDX 2.3 SBOMs and its own license findings. LicenseFinder's per-package approval policy remains a fine narrow complement.
No migration, no rip-and-replace. LicenseFinder keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise LicenseFinder results in Vulnetix
Upload LicenseFinder JSON, CSV, HTML, Text output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.