foretop lading — AI asset licence checker
Know every licence obligation before it ships.
Lading discovers Python dependencies and AI assets, resolves their licences, and turns them into reviewable obligations and explicit policy decisions.
Available now · Apache-2.0
What it checks
A bounded scanner with explicit evidence and an honest unknown state.
Trace packages and AI assets
Read uv.lock, poetry.lock and requirements.txt, Hugging Face model and dataset references, vendored PEFT adapters, and optional CycloneDX SBOM input.
Keep provenance attached
Resolve the discovered package version or Hugging Face revision through its exact registry metadata, with curated overrides and unknowns intact.
Apply only the policy you chose
Decompose attribution, redistribution, acceptable-use, field-of-use, and share-alike obligations before evaluating an explicit policy.
Use it locally or as a CI gate
Start report-only
Without --policy, Lading reports and exits successfully. A named preset or YAML policy makes exit 1 mean an explicit violation; warnings alone never fail CI.
One result, several renderers
Choose table, JSON, Mermaid, Markdown, SARIF, annotations, and triage JSON without changing what the scan concluded.
Annotate the pull request
The public repository includes a composite GitHub Action that emits annotations, maintains one summary comment, and preserves the CLI's exit code.
Trust boundary
What leaves the machine?
Repository discovery is local. Licence resolution sends package or asset identifiers plus discovered versions or revisions—not source contents—to the public PyPI and Hugging Face APIs. The machine-wide Hugging Face cache is read only when requested.
What is outside today's boundary?
- Native dependency discovery reads the Python lockfile formats — uv.lock, poetry.lock and requirements.txt. Node lockfiles are not read; they can be supplied through CycloneDX instead.
- Direct-versus-transitive and production-versus-development scope is derived from uv.lock and poetry.lock, which carry a resolved dependency graph. A requirements file has neither edges nor groups, so its packages carry no scope attribute rather than a guessed one.
- Namespace-less Hugging Face model identifiers may be indistinguishable from ordinary strings.
- This is engineering evidence to review with counsel, not legal advice.
Run it on yours
Install the published package, scan the current directory, and inspect every result before deciding whether to gate CI.