oss-review-toolkit/ort

Health v2 · maintenance only

Adoption not part of the score

2075 stars · 392 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

The OSS Review Toolkit (ORT) is a FOSS policy automation toolkit that analyzes project dependencies, scans licenses and copyrights, checks security vulnerabilities, and generates SBOMs (SPDX, CycloneDX) and attribution documents. It can be used as a library, CLI, or CI integration and combines tools like Analyzer, Downloader, Scanner, and Advisor into customizable pipelines.

Use cases

• generate spdx or cyclonedx sbom for my project
• automate open source license compliance checks in ci
• create attribution documents for third-party dependencies
• scan dependencies for security vulnerabilities
• check licenses and copyrights of npm and maven dependencies
• enforce foss policy as code across repositories
• archive source code of all dependencies for license compliance

When to choose

• you need automated license, copyright, and vulnerability compliance across many package managers
• you must produce SBOMs or attribution docs for regulatory or customer requirements
• you want policy-as-code enforcement in CI pipelines

When to avoid

• you only need a quick one-off license scan without pipeline setup
• you need a lightweight GUI-only tool rather than a configurable toolkit
• your project uses package managers not supported by ORT's analyzer

Facets

cli-tool · maturity active

security dependency-audit developer-tools ci-cd parser documentation developer-tools security legal jvm cli cross-platform sbom spdx cyclonedx license-compliance open-source-compliance software-composition-analysis policy-as-code kotlin automation devops docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="oss-review-toolkit/ort")