Feluda

🔎 Feluda is a Rust-based command-line tool that analyzes the dependencies of a project, notes down their licenses, and flags any permissions that restrict personal or commercial usage.

👋 It's still highly experimental, but fast iterating. Welcoming contributors and support to help bring out this project even better!

Features

• Parse your project to identify dependencies and their licenses.
• Classify licenses into permissive, restrictive, or unknown categories.
• Flag dependencies with licenses that may restrict personal or commercial use.
• Output results in plain text, JSON or TUI formats. There's also a gist format which is available in strict mode to output a single line only.

Support Languages

Feluda supports analyzing dependencies across multiple languages simultaneously. You can also filter the analysis to a specific language using the --language flag.

feluda --language {rust|node|go|python}

If your fav language or framework isn't supported, feel free to open an feature request issue! 👋

Installation

Official Distribution 🎉:

cargo install feluda

Community Maintained 🙌:

brew install feluda

paru -S feluda

pkgin install feluda

Track releases on github releases or via release feed.

git clone https://github.com/anistark/feluda.git
cd feluda

cargo build --release

sudo mv target/release/feluda /usr/local/bin/

Usage

Basic Usage

Run the tool in the project directory:

feluda

Specify a Path to your project directory

feluda --path /path/to/project/

If you're using Feluda, feel free to grab a Scanned with Feluda badge for your project:

[![Scanned with Feluda](https://img.shields.io/badge/Scanned%20with-Feluda-red)](https://github.com/anistark/feluda)

Output Format

• Default: Plain text.
• JSON: Use the --json flag for JSON output.

feluda --json

Sample Output for a sample cargo.toml file containing serde and tokio dependencies:

[
  {
    "name": "serde",
    "version": "1.0.151",
    "license": "MIT",
    "is_restrictive": false
  },
  {
    "name": "tokio",
    "version": "1.0.2",
    "license": "MIT",
    "is_restrictive": false
  }
]

Verbose Mode

For detailed information about each dependency:

feluda --verbose

Strict Mode

In case you strictly need only the restrictive dependencies:

feluda --strict

TUI Mode

We've an awesome ✨ TUI mode available to browse through the dependencies in a visually appealing way as well:

feluda --gui

Checkout contributing guidelines if you are looking to contribute to this project.

Currently, using choosealicense license directory for source of truth.

Configuration

Feluda allows you to customize which licenses are considered restrictive through configuration. This can be done in three ways, listed in order of precedence (highest to lowest):

1. Environment variables
2. .feluda.toml configuration file
3. Default values

Default Restrictive Licenses

By default, Feluda considers the following licenses as restrictive:

• GPL-3.0
• AGPL-3.0
• LGPL-3.0
• MPL-2.0
• SEE LICENSE IN LICENSE
• CC-BY-SA-4.0
• EPL-2.0

Configuration File

Create a .feluda.toml file in your project root to override the default restrictive licenses:

[licenses]
# Override the default list of restrictive licenses
restrictive = [
    "GPL-3.0",      # GNU General Public License v3.0
    "AGPL-3.0",     # GNU Affero General Public License v3.0
    "Custom-1.0",   # Your custom license identifier
]

Environment Variables

You can also override the configuration using environment variables:

# Override restrictive licenses list
export FELUDA_LICENSES_RESTRICTIVE='["GPL-3.0","AGPL-3.0","Custom-1.0"]'

The environment variables take precedence over both the configuration file and default values.

License

Feluda is licensed under the MIT License.

Happy coding with Feluda! 🚀