License scanners use three methods. Manifest reading takes the declared license from package metadata. File text matching reads LICENSE files and compares them with known texts. Snippet matching compares code fragments with known sources. Manifests are fastest, file matching is more grounded, and snippets catch copied code the others miss.
The three methods
| Method | How it works | Strength | Weakness |
|---|---|---|---|
| Manifest or metadata | Reads the license field, expression or classifier | Fast, structured, scalable | Author's claim, can be wrong or empty |
| File text matching | Finds files such as LICENSE or COPYING and matches text | Closer to what was actually granted | Edited text, odd file names, multiple licenses |
| Snippet matching | Compares code fragments with a corpus | Finds copied code with no metadata | Heavier, false positives, depends on corpus |
What the documentation tells us
Ecosystem docs show how uneven metadata is. npm accepts an SPDX identifier, an expression, a pointer to a custom file, or UNLICENSED. Python moved to a validated License-Expression field after years of free text and classifiers. Go has no field at all, and the Go package site states plainly that its file based detection is a heuristic with no accuracy guarantee. A good scanner combines methods and says which one produced each answer.
How to choose and combine
- Use manifest data as the first pass for every dependency.
- Verify with file text for anything your policy treats as sensitive.
- Use snippet matching where copied code is likely: vendored folders, acquired code, AI generated code you cannot trace.
- Keep the confidence level next to each result, so reviewers know what was inferred.
- Send disagreements between methods to manual review.
Questions to ask a tool
Does it parse expressions with AND, OR and WITH? Does it show where each answer came from? Can you override a wrong result and keep the override? Does it scan vendored folders and container layers? See SCA license detection: what to expect for more.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at which metadata an inventory entry carries and think about which method would produce it.
Be wary of single number accuracy claims for any detector. Accuracy depends on your ecosystems, your vendored code and how many odd licenses you have. Test a tool on a sample of your own repositories, compare its answers with a manual review of twenty or thirty packages, and look at the disagreements. That gives you a more honest picture than a headline figure.
Safeguard offers SBOM and dependency scanning. A free scan lets you judge the output on your own code.
Quick check
Which method is most accurate?
None alone. Combine them and keep confidence labels.
Why not trust the declared license field?
It is the author's claim. It can be empty, outdated or inconsistent with the license file.
Sources
- npm Docs, package.json, license: https://docs.npmjs.com/cli/v10/configuring-npm/package-json#license
- PEP 639: https://peps.python.org/pep-0639/
- Go package discovery site, license policy: https://pkg.go.dev/license-policy
Last reviewed: 19 October 2026.
