SourceTrust

Input—per 1M tokens

Output—per 1M tokens

Context—tokens

WeightsClosed

About

SourceTrust is ranked #7 of 27 in open source license compliance software on Inferse. It runs on Web. There is a free plan. Paid plans start at $24.92/mo.

Compared on open source license compliance software

Free plan: Yessourcetrust.dev
Paid from: $299/yrsourcetrust.dev
Policy enforcement: bothsourcetrust.dev
Obligation tracking: Yessourcetrust.dev
Attribution reports: Yessourcetrust.dev
SBOM import formats: CycloneDX, SPDXsourcetrust.dev
Deployment options: cloudsourcetrust.dev
Source scan methods: multiplesourcetrust.dev

Facts

Purpose: SourceTrust helps teams review third-party software licenses and publish a shareable license compliance page for products they ship.sourcetrust.dev · 29 Sept 2026
Inventory: It gathers direct and transitive dependencies from repositories, lockfiles, and SBOMs into one inventory.sourcetrust.dev · 29 Sept 2026
Verification: SourceTrust retrieves the shipped package, checks it against the registry digest, and reads the license text inside it.sourcetrust.dev · 29 Sept 2026
Review gates: Nothing is published until the team has reviewed and confirmed the record, and the product flags packages that need a decision.sourcetrust.dev · 29 Sept 2026
Integrations: The site lists GitHub, GitLab, and Azure DevOps repository connections, plus lockfile and SBOM imports.sourcetrust.dev · 29 Sept 2026
Supported inputs: The platform overview says it supports 14 formats across 9 ecosystems, including CycloneDX SBOM uploads.sourcetrust.dev · 29 Sept 2026
Exports: Outputs include a hosted attestation page, THIRD_PARTY_LICENSES.md, NOTICE, CycloneDX, SPDX, JSON, CSV, plist, and branded PDF.sourcetrust.dev · 29 Sept 2026
Change monitoring: Repository sync and publish-drift checks flag when the live inventory differs from the published snapshot.sourcetrust.dev · 29 Sept 2026
Security controls: Pages can be password-protected and excluded from search engines, and optional vulnerability findings remain vendor-only.sourcetrust.dev · 29 Sept 2026
Data access: SourceTrust says it reads lockfiles and SBOMs, never source code, and parses lockfiles in the browser before upload.sourcetrust.dev · 29 Sept 2026
Open source eligibility: Eligible public GitHub projects can publish an attestation page for $0 with no card or trial clock, subject to fair use and SourceTrust attribution.sourcetrust.dev · 29 Sept 2026
Free review: Projects, dependency imports, and license reviews are free for as long as needed; standard project billing starts on first publish or export download.sourcetrust.dev · 29 Sept 2026
Support: SourceTrust offers a live walkthrough and lists [email protected] for platform questions.sourcetrust.dev · 29 Sept 2026
Audience and limitation: The company describes the product as license compliance infrastructure for shipped products and says it is software tooling, not a law firm or legal advice.sourcetrust.dev · 29 Sept 2026