Evergreen Tools
|
← Back to AI Tools

SCANOSS Earnie Open Source License Compliance

Snippet-level license obligation detection for code moving at agent speed

Tool Overview

Details, capabilities and usage guidance

Features

  • ✓ Detection down to the individual snippet, not just the declared dependencies a typical SCA tool sees
  • ✓ The same deterministic, knowledge-base-backed detection covers a developer's own commits, copied or vendored code, and anything an AI agent introduces
  • ✓ Over MCP, a coding agent can ask whether a component is allowed under project policy before adding it, getting pass, warn or flag-for-review guidance in the moment
  • ✓ Covers CLI and pre-commit checks plus GitHub Actions and pull-request checks, with policy comments and pass/warn signals on every PR
  • ✓ Generates attribution and notice files and keeps a versioned CycloneDX/SPDX SBOM that can be exported or seeded by importing an existing SBOM

How to Use

  1. Connect Earnie to your coding agent over MCP so it can check policy before adding a dependency
  2. Install the CLI and wire up the pre-commit hook to run license and obligation checks at the keyboard
  3. Add the GitHub Actions integration so every pull request gets policy comments and pass/warn signals
  4. Use the Earnie UI as the standing record of findings, decisions and evidence, exporting SBOMs on demand or importing an existing CycloneDX/SPDX SBOM as a baseline

FAQ

What is SCANOSS Earnie?

A major release of SCANOSS's software governance platform, publicly launched at a live online event on 6 October 2026. SCANOSS positions it as a continuous programme organised around dated Releases rather than a point-in-time scan, arguing that code — including AI-written code — now moves faster than manual review can follow.

How is it different from a traditional SCA tool?

Typical SCA looks at declared dependencies, while Earnie checks down to the individual snippet: a developer's own commits, copied or vendored code, and code introduced by AI agents all pass through the same deterministic, knowledge-base-backed detection.

Does my source code get uploaded?

SCANOSS says no. Each customer works in its own isolated environment, source code stays on the customer side, and only fingerprints and hashes are shared with SCANOSS for matching.

Why target AI coding agents specifically?

SCANOSS's argument is that an agent has no memory of a company's license policy, no instinct that a snippet might carry an obligation, and no reason to flag what it just wrote — so as agents commit code at volume, the gap stops being one violation at a time and becomes exposure at scale, quietly across dozens of commits a day.

What does it produce?

For each component Earnie maps the applicable license and its obligations, generates attribution and notice files, and keeps a versioned software bill of materials in open standards (CycloneDX and SPDX) ready to export; an existing CycloneDX or SPDX SBOM can also be imported so teams do not rebuild their inventory from zero.

Is it available now and where can I learn more?

SCANOSS says Earnie is available now, with full release details — including coverage of AI governance and post-quantum cryptography readiness — at earnie.dev.