License compliance report for procurement reviews

The idea

The moment an indie SaaS lands its first enterprise prospect, procurement sends the questionnaire, and one line reliably stalls the deal: provide an audit of third-party software licences. The founder has no idea what is in their transitive dependency tree, whether some ancient sub-dependency is GPL, or what format an acceptable answer even takes, so a closed-won deal sits in legal limbo for weeks.

FOSSA and Snyk cover this, but they are shaped and priced for compliance teams running continuous programmes. The wedge is the moment: upload lockfile, get a PDF an enterprise buyer accepts, today. The buyer does not want a platform, they want to unblock one deal, which is why a one-off price works better than a subscription here.

Who pays

The buyer is an indie or seed-stage SaaS founder mid-procurement, the strongest willingness-to-pay situation there is because real revenue is blocked. At 49 to 99 dollars one-off, it is a no-thought expense against a five-figure contract. Distribution: SEO on the exact panic queries (open source license audit for enterprise questionnaire, is my app GPL compliant), founder communities where procurement war stories circulate, and security-questionnaire adjacent content.

MVP scope

• Lockfile parsing for npm/yarn/pnpm, Python and Go, transitive dependencies included
• Licence resolution via registries with LICENSE-file fallback and honest unknown flagging
• Copyleft classification with GPL/AGPL prominently surfaced
• Branded PDF export plus SPDX JSON and an attribution notices file
• Free on-screen summary, Stripe checkout for the export, no account needed
• Skip for v1: continuous CI monitoring, Java/Ruby/Rust ecosystems, legal-advice interpretations, policy engines, vulnerability scanning

Build ClearLicense, a tool that turns a dependency lockfile into a licence compliance report an enterprise buyer will accept. Stack: Next.js app with Node.js parsing logic in API routes, Stripe checkout for one-off purchases.

Core flow: user drags in a lockfile: package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt/poetry.lock, or go.mod/go.sum. Server-side, parse the full dependency tree (transitives included, that is where the GPL surprises hide) and resolve each package's licence: read the registry metadata first (npm registry, PyPI, pkg.go.dev), fall back to fetching and pattern-matching the package's LICENSE file, and mark anything unresolvable as unknown rather than guessing. Classify every licence: permissive (MIT, Apache-2.0, BSD, ISC), weak copyleft (LGPL, MPL), strong copyleft (GPL, AGPL, flagged prominently), and unknown/nonstandard.

Free output on-screen: the summary counts and the flagged list, enough to prove value. The paid product is the export: a clean, branded PDF, company name and logo, date, methodology paragraph, full dependency inventory with licences, SPDX identifiers throughout, plus a machine-readable SPDX JSON file, formatted to be attached directly to a security questionnaire. Include an attribution/notices file generator since enterprise legal often asks for that next.

Pages: landing targeting the stalled-deal moment, upload/report page, PDF preview, buy page. No accounts required for a one-off purchase; email the PDF and a re-download link.

Pricing: 49 GBP per report, 99 GBP for a three-pack; report includes one free re-run within 30 days.