vow_scan
Scan project dependencies to identify licenses and validate them against a policy file, flagging disallowed or unknown licenses for compliance checks before releases or when adding new packages.
Instructions
Scan all dependency licenses in a project and — if a policy file is present — validate each package against that policy, flagging disallowed licenses (e.g. GPL in a proprietary codebase) or packages with unknown licenses.
When to use: before shipping a release, when adding a new dependency, during compliance or legal review, or as a CI gate. Set production: true to skip devDependencies and audit only what actually ships.
Side effects: reads supported lockfiles (package-lock.json or npm-shrinkwrap.json for Node; Cargo.lock for Rust; requirements.txt with hashes, uv.lock, or poetry.lock for Python) plus local node_modules / vendor manifests to resolve license strings. Pnpm, yarn, and go are not yet supported — vow exits with a clear error when only those lockfiles are present. Read-only; no network requests.
Returns: plain-text, JSON, or markdown summary of package → license mapping grouped by license family (MIT/Apache/BSD/GPL/unknown), with per-package links. Exit 1 if any dependency violates the policy or has an unknown license, 0 otherwise.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Absolute or relative path to the project root to scan. Defaults to the current working directory. | |
| format | No | Response format: "terminal" for human-readable ANSI-colored output, "json" for machine-parseable structured data, "markdown" for rendered tables (where supported). Defaults to "terminal". | |
| production | No | When true, exclude devDependencies from the scan and audit only runtime dependencies that ship with the published package. Use this for release-gate checks; leave false for full audits. |