ORT Dependency License Checker - Claude Code Hook

Features

• Watches dependency manifest and lockfile edits through a Claude Code PostToolUse hook.
• Uses the official OSS Review Toolkit workflow as the source-backed license-analysis path: ORT's analyzer determines dependencies and metadata across package managers, and its evaluator/reporter stages can apply policy and produce license reports.
• Keeps the default hook safe and lightweight: it prints the exact ORT command to run and exits 0.
• Supports an explicit local execution mode with ORT_LICENSE_HOOK_RUN=1 for teams that already have ORT installed and understand the package-manager/network behavior.
• Supports optional strict failure behavior with ORT_LICENSE_HOOK_STRICT=1 only after local ORT execution is enabled.

How it works

The hook reads the Claude Code tool input, extracts the edited file path, and exits unless the file is a dependency manifest or lockfile. For relevant edits, it prints a local ORT license-analysis command. If ORT_LICENSE_HOOK_RUN=1 is set, it runs ort --info analyze -f JSON -i . -o .claude/ort-license-checks/<timestamp> from the project root.

The output is intentionally analyzer-focused. ORT's own documentation describes the analyzer as the stage that determines project dependencies and metadata, and the evaluator/reporter stages as the right places to apply license policy and generate reviewable artifacts. That keeps this hook from pretending every organization has the same license policy.

Supported edit targets

• npm: package.json, package-lock.json, npm-shrinkwrap.json
• pnpm and Yarn: pnpm-lock.yaml, yarn.lock
• Bun: bun.lock, bun.lockb
• Rust: Cargo.toml, Cargo.lock
• Go: go.mod, go.sum
• Python: pyproject.toml, poetry.lock, requirements.txt, Pipfile, Pipfile.lock
• JVM: pom.xml, build.gradle, build.gradle.kts, settings.gradle
• Ruby: Gemfile, Gemfile.lock
• PHP: composer.json, composer.lock

Use cases

• Remind Claude and the developer to review license impact immediately after an agent edits dependencies.
• Run a local ORT analyzer pass before opening a PR that changes package manifests.
• Keep license-policy interpretation in the project's ORT evaluator rules rather than baking one organization's policy into a generic hook.
• Create a low-friction local guardrail before heavier CI-based ORT, SBOM, or legal-compliance review.

Installation

1. Create the hooks directory: mkdir -p .claude/hooks
2. Create the hook file: touch .claude/hooks/ort-dependency-license-checker.sh
3. Paste the script body into that file and make it executable: chmod +x .claude/hooks/ort-dependency-license-checker.sh
4. Add the configuration below only to this trusted project's .claude/settings.json. Do not put this $CLAUDE_PROJECT_DIR/.claude/hooks/... command in ~/.claude/settings.json; a global hook must point to a trusted user-owned absolute path outside project directories.
5. Install and configure ORT only if you want the hook to run analysis locally.

Hook configuration

Use this project-local configuration only in the trusted repository that contains the script.

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Write|Edit|MultiEdit",
        "hooks": [
          {
            "type": "command",
            "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/ort-dependency-license-checker.sh"
          }
        ]
      }
    ]
  }
}

Optional local execution

Keep advisory mode for most projects:

unset ORT_LICENSE_HOOK_RUN

Run ORT locally when dependency edits happen:

export ORT_LICENSE_HOOK_RUN=1

Fail the Claude tool call when the opted-in ORT analysis fails:

export ORT_LICENSE_HOOK_RUN=1
export ORT_LICENSE_HOOK_STRICT=1

Customize report location and timeout:

export ORT_LICENSE_HOOK_OUT=.claude/ort-license-checks/current
export ORT_LICENSE_HOOK_TIMEOUT=600

Limitations

• Default mode is a reminder, not a completed license review.
• ORT analyzer output is metadata, not a legal decision. Use evaluator rules, project policy, and human review for license approval.
• Running ORT may need Java, package-manager CLIs, network access, registry credentials, and project-specific configuration.
• Large monorepos can take longer than an interactive hook budget; keep heavy ORT runs in CI if local hook latency becomes disruptive.

Source and references

• OSS Review Toolkit: https://oss-review-toolkit.org/ort/
• ORT usage documentation: https://oss-review-toolkit.org/ort/docs/getting-started/usage
• ORT repository: https://github.com/oss-review-toolkit/ort
• Claude Code hooks documentation: https://docs.anthropic.com/en/docs/claude-code/hooks

Duplicate check

Checked current content for OSS Review Toolkit, oss-review-toolkit/ort, ORT, dependency license checker, LicenseFinder, licensed, and go-licenses. Existing entries cover broader security scanners, secret scanners, dependency vulnerability checks, lockfile provenance, Socket MCP security reports, and a SLSA provenance review skill, but no existing hook or open content PR covers an ORT-backed dependency license-compliance hook.

• Source repositorygithub.com 2026-07-19T11:20:19-07:00
• Documentationoss-review-toolkit.org
• Websiteoss-review-toolkit.org
• Submitted by oktofeesh12026-06-04