foretop

foretop lading — AI asset licence checker

Know every licence obligation before it ships.

Lading discovers Python dependencies and AI assets, resolves their licences, and turns them into reviewable obligations and explicit policy decisions.

Available now · Apache-2.0

What it checks

A bounded scanner with explicit evidence and an honest unknown state.

Discover

Trace packages and AI assets

Read uv.lock, Hugging Face model and dataset references, vendored PEFT adapters, and optional CycloneDX SBOM input.

Resolve

Keep provenance attached

Resolve licence metadata through PyPI, Hugging Face, and curated overrides while leaving missing or conflicting evidence unknown.

Decide

Apply only the policy you chose

Decompose attribution, redistribution, acceptable-use, field-of-use, and share-alike obligations before evaluating an explicit policy.

Use it locally or as a CI gate

Default

Start report-only

Without --policy, Lading reports and exits successfully. A named preset or YAML policy makes exit 1 mean an explicit violation; warnings alone never fail CI.

Output

One result, several renderers

Choose table, JSON, Mermaid, Markdown, SARIF, annotations, and triage JSON without changing what the scan concluded.

Action

Annotate the pull request

The public repository includes a composite GitHub Action that emits annotations, maintains one summary comment, and preserves the CLI's exit code.

Trust boundary

What leaves the machine?

Repository discovery is local. Licence resolution sends package or asset identifiers—not source contents—to the public PyPI and Hugging Face APIs. The machine-wide Hugging Face cache is read only when requested.

What is outside today's boundary?
  • Native dependency discovery currently reads uv.lock; other ecosystems can be supplied through CycloneDX.
  • Namespace-less Hugging Face model identifiers may be indistinguishable from ordinary strings.
  • This is engineering evidence to review with counsel, not legal advice.

Run it on yours

Install the published package, scan the current directory, and inspect every result before deciding whether to gate CI.