# Dependency License Auditor (`junipr/dependency-license-auditor`) Actor

Audit dependency manifests for license types, unknown licenses, and policy risk.

- **URL**: https://apify.com/junipr/dependency-license-auditor.md
- **Developed by:** [junipr](https://apify.com/junipr) (community)
- **Categories:** Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $6.50 / 1,000 operation testeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Dependency License Auditor

### Store Positioning

**Store title:** Dependency License Auditor

**Short description:** Audit dependency manifests for license types, unknown licenses, and policy risk.

**SEO title:** Dependency License Auditor — API, schema, and developer QA

**SEO description:** Audit dependency manifests for license types, unknown licenses, and policy risk. Use it to catch contract drift, schema mistakes, unsafe endpoint assumptions, and developer-tool quality issues before release.

**Categories:** DEVELOPER\_TOOLS

**Keywords:** dependency, license, auditor, api/developer qa

### Fixed-Inclusive PPE Pricing

This actor uses pay-per-event pricing. Event prices include Apify platform usage; users are not expected to pay a separate platform-usage pass-through charge for the configured pricing model.

- Tier: A1 — API/developer QA
- Primary event: `operation-tested` at $0.00650 base
- Default max charge: $10.00
- Store discounts: FREE/BRONZE base, SILVER discounted, GOLD deepest approved discount

Event set:

- `actor-start`: base $0.00500, GOLD $0.00400. Dependency License Auditor: charged when actor start is completed. The price includes Apify platform usage; no separate usage pass-through is intended.
- `operation-tested`: base $0.00650, GOLD $0.00520. Dependency License Auditor: charged when operation tested is completed. The price includes Apify platform usage; no separate usage pass-through is intended.
- `contract-rule-checked`: base $0.00390, GOLD $0.00312. Dependency License Auditor: charged when contract rule checked is completed. The price includes Apify platform usage; no separate usage pass-through is intended.
- `report-generated`: base $0.05000, GOLD $0.04000. Dependency License Auditor: charged when report generated is completed. The price includes Apify platform usage; no separate usage pass-through is intended.

### Public Task Concepts

- Audit Dependency License controls on a capped public sample
- Find high-priority Dependency License issues before release
- Validate Dependency License evidence from supplied pages
- Prioritize Dependency License fixes with severity and proof
- Export Dependency License QA rows for client review

Audit dependency manifests for license types, unknown licenses, and policy risk.

### What This Actor Does

Dependency License Auditor turns explicit watchlists or supplied records into structured Apify dataset rows and a concise report. The capped built-in records make the default run deterministic and avoid network, browser, proxy, LLM, or third-party API costs.

The actor checks each supplied record for source identity, matched watch terms, actor-specific metadata, issue signals, severity, recommendations, and pricing metadata. It writes one dataset row per processed record and, when enabled, key-value-store JSON and Markdown summaries for operational workflows.

### What This Actor Does Not Do

- It does not provide legal, medical, financial, investment, safety, or compliance advice.
- It does not guarantee completeness of any public source or third-party dataset.
- It does not collect sensitive personal data by default.
- It does not rely on unsupported private APIs.

### Best Use Cases

- manifest license checks
- open-source policy reviews
- unknown-license triage

### Input Fields Explained

| Field | Type | Default | Notes |
| --- | --- | --- | --- |
| `records` | array | two built-in records | Records or snapshots to check. Each item can include title, description, body, entity, category, keywords, and metadata. |
| `urls` | array | \[] | Reserved for optional source URLs. Defaults do not fetch URLs. |
| `fetchUrls` | boolean | false | Enables HTTP fetching for records with sourceUrl and no body. Keep false when records already contain the text to analyze. |
| `watchTerms` | array | actor defaults | Terms used to mark relevant records and alerts. |
| `includeReport` | boolean | true | Writes JSON and Markdown report artifacts to the key-value store. |
| `maxItems` | integer | 2 | Caps processed records. Maximum is 50. |
| `maxTextBytes` | integer | 500000 | Caps analyzed text per record. |
| `debug` | boolean | false | Enables debug logging. |

### Example Input

```json
{
  "records": [
    {
      "sourceId": "dep-react",
      "sourceUrl": "package.json",
      "title": "react dependency",
      "description": "react dependency in production manifest uses MIT license.",
      "entityName": "react",
      "category": "dependency",
      "keywords": [
        "MIT"
      ],
      "metadata": {
        "packageName": "react",
        "version": "19.0.0",
        "license": "MIT",
        "policy": "allowed"
      }
    },
    {
      "sourceId": "dep-risk",
      "sourceUrl": "package.json",
      "title": "legacy-report dependency",
      "description": "legacy-report dependency has GPL-3.0 license and unknown policy approval.",
      "entityName": "legacy-report",
      "category": "dependency",
      "keywords": [
        "GPL"
      ],
      "metadata": {
        "packageName": "legacy-report",
        "version": "1.2.3",
        "license": "GPL-3.0",
        "policy": "unknown"
      }
    }
  ],
  "includeReport": true,
  "maxItems": 2
}
```

### Output Fields Explained

| Field | Meaning |
| --- | --- |
| `auditId` | Stable hash for the checked record. |
| `sourceId`, `sourceUrl` | Source identifiers for traceability. |
| `status`, `severity`, `score` | Normalized outcome and 0-100 quality/risk score. |
| `matchedKeywords` | Watch terms found in the record text or metadata. |
| `issues`, `issueCodes` | Actor-specific findings with severity and messages. |
| `recommendations` | Next actions for the operator or content/data owner. |
| `metadata` | Original metadata plus derived helper fields when applicable. |
| `pricingTemplate`, `pricingEventName` | Pricing source and primary PPE event used by the actor. |

### Example Output

```json
{
  "auditId": "dependen_a82e804f031934c4",
  "actorSlug": "dependency-license-auditor",
  "actorName": "Dependency License Auditor",
  "sourceType": "fixture",
  "sourceId": "dep-react",
  "sourceUrl": "package.json",
  "title": "react dependency",
  "status": "pass",
  "severity": "none",
  "score": 100,
  "matchedKeywords": [],
  "primaryEntity": "react",
  "category": "dependency",
  "publishedAt": null,
  "summary": "react dependency in production manifest uses MIT license.",
  "issueCount": 0,
  "issues": [],
  "issueCodes": [],
  "recommendations": [
    "Dependency License Auditor did not find immediate risk signals for this record. Re-run after source data changes."
  ],
  "metadata": {
    "packageName": "react",
    "version": "19.0.0",
    "license": "MIT",
    "policy": "allowed",
    "sourceSpecific": {
      "licenseRows": [
        {
          "packageName": "react",
          "license": "MIT",
          "policyStatus": "allowed"
        }
      ]
    },
    "normalizedTextPreview": "dep-react package.json react dependency react dependency in production manifest uses MIT license.  react dependency MIT {\"packageName\":\"react\",\"version\":\"19.0.0\",\"license\":\"MIT\",\"policy\":\"allowed\"}"
  },
  "textBytes": 197,
  "checkedAt": "2026-07-02T00:00:00.000Z",
  "pricingTemplate": "A1 — API/developer QA",
  "pricingEventName": "operation-tested"
}
```

### Cost-Control Tips

- Keep `maxItems` small for default and scheduled checks.
- Use supplied records or snapshots for deterministic QA runs.
- Leave `fetchUrls` off unless live source fetching is explicitly needed.
- Review warning rows before increasing caps.
- Schedule small frequent runs instead of broad one-off sweeps.

### Scheduling Examples

- Daily watchlist check with two to five high-value records.
- Weekly QA run before publishing a site, data, or actor update.
- Post-migration or post-release validation using a saved record set.

### Public Task Examples

- `tiny-default-check` - Run a two-record dependency license auditor check with report artifacts enabled.
- `watchlist-digest` - Process a small supplied watchlist and summarize matched terms.
- `risk-triage-report` - Return only records with warning or fail status for operator follow-up.
- `scheduled-monitor` - Run Dependency License Auditor on a daily or weekly schedule with tight caps.
- `schema-and-billing-preflight` - Validate output shape and PPE event names before live setup.

### FAQ

#### Can I schedule recurring checks?

Yes. Save a capped input and use Apify schedules to run it daily or weekly.

#### Can I use this with live URLs?

Yes. Set `fetchUrls` to true and provide `urls` or records with `sourceUrl`. Failed fetches produce explicit diagnostic rows.

#### Why does it charge before pushing output?

Pay-per-event actors must charge before paid output is written. If the charge limit is reached, processing stops before another paid row is emitted.

#### What happens on charge limits?

The actor stops gracefully and writes a summary instead of pushing unpaid result rows.

#### Is this legal, financial, safety, or compliance advice?

No. The actor produces operational signals and structured data for review. Human owners remain responsible for decisions.

### Troubleshooting

- If the dataset is empty, check that `maxItems` is greater than zero and that records are supplied or defaults are enabled.
- If a record is flagged unexpectedly, inspect `issueCodes`, `matchedKeywords`, and the normalized metadata preview.
- If live fetching fails, rerun with supplied record bodies or snapshots and keep `fetchUrls` false.

### Limitations

This actor only sees the records, snapshots, or URLs supplied to it. It does not guarantee complete public-source coverage, private-source access, or all edge-case parsing. Browser and proxy flows are not used by default.

### Source And Safety Notes

The built-in records are labeled through `sourceType: "fixture"` and are intended to show the output contract. When connecting public sources, use official or permissioned endpoints where possible and avoid sensitive personal data. Do not use the output as a substitute for professional advice.

### Changelog

- 2026-07-02: Initial actor package with schemas, capped defaults, pricing controls, and runtime validation.

# Actor input Schema

## `records` (type: `array`):

Records, snapshots, or source observations to process. Defaults to two capped built-in records.

## `urls` (type: `array`):

Optional URLs reserved for live fetching when Fetch URLs is true.

## `fetchUrls` (type: `boolean`):

Fetch sourceUrl text over HTTP. Keep false when records already contain the text to analyze.

## `watchTerms` (type: `array`):

Keywords or topics used to flag relevant records.

## `includeReport` (type: `boolean`):

Write JSON and Markdown report artifacts to the key-value store.

## `maxItems` (type: `integer`):

Maximum records to process in one run.

## `maxTextBytes` (type: `integer`):

Maximum searchable text bytes per record.

## `dryRun` (type: `boolean`):

Validate input and write a dry-run summary without PPE charges or dataset output.

## `debug` (type: `boolean`):

Enable debug logging.

## Actor input object example

```json
{
  "records": [
    {
      "sourceId": "dep-react",
      "sourceUrl": "package.json",
      "title": "react dependency",
      "description": "react dependency in production manifest uses MIT license.",
      "entityName": "react",
      "category": "dependency",
      "keywords": [
        "MIT"
      ],
      "metadata": {
        "packageName": "react",
        "version": "19.0.0",
        "license": "MIT",
        "policy": "allowed"
      }
    },
    {
      "sourceId": "dep-risk",
      "sourceUrl": "package.json",
      "title": "legacy-report dependency",
      "description": "legacy-report dependency has GPL-3.0 license and unknown policy approval.",
      "entityName": "legacy-report",
      "category": "dependency",
      "keywords": [
        "GPL"
      ],
      "metadata": {
        "packageName": "legacy-report",
        "version": "1.2.3",
        "license": "GPL-3.0",
        "policy": "unknown"
      }
    }
  ],
  "urls": [],
  "fetchUrls": false,
  "watchTerms": [
    "GPL",
    "AGPL",
    "unknown"
  ],
  "includeReport": true,
  "maxItems": 2,
  "maxTextBytes": 500000,
  "dryRun": false,
  "debug": false
}
```

# Actor output Schema

## `results` (type: `string`):

Structured result rows in the default dataset.

## `summary` (type: `string`):

Summary JSON in the key-value store when includeReport is enabled.

## `markdownReport` (type: `string`):

Markdown report in the key-value store when includeReport is enabled.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("junipr/dependency-license-auditor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("junipr/dependency-license-auditor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call junipr/dependency-license-auditor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=junipr/dependency-license-auditor",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

```

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/acts/rlJYfPK2WHt49MELB/builds/b7pezJEjaW1lRoe32/openapi.json