Cavil is a legal review and Software Bill of Materials (SBOM) system. It is used in the development of openSUSE Tumbleweed, openSUSE Leap, as well as SUSE Linux Enterprise.

Important: Note that most of the data used by Cavil has been curated by lawyers, but the generated reports do not count as legal advice and no guarantees are made for their correctness!

Features

Scanning & detection

• Source code legal review for RPMs, DEBs, tarballs and various other package formats
• High performance scanner with recursive decompression of almost any archive format
• 28.000 curated patterns for 2000 license combinations with 500 distinct SPDX expressions
• Detection of vendored/bundled subcomponents (npm, Cargo, PyPI, Maven, Go, Composer, NuGet, RubyGems) shipped inside packages, surfaced in the SBOM and the review report

SBOM & compliance

• Software Bill of Materials (SBOM) generation in SPDX 3.0.1 format, compliant with the EU Cyber Resilience Act (CRA) as specified by BSI TR-03183-2
• Package and component (purl) search, plus a component export, for supply-chain and vulnerability triage

Review workflow

• Legal risk assessments by lawyers for every pattern match
• Human reviews with approval/rejection workflow, and optional automatic approvals based on risk
• Machine learning text classification of snippets, which drives Cavil's automated resolution of scanner noise

Integrations

• MCP support for integration into AI assisted legal review workflows
• REST API for integration into existing source code management systems
• Open Build Service and Gitea integration via bots
• Direct tarball upload, for one-off analysis without any bot integration
• OpenID Connect (OAuth 2.0) authentication

AI

Cavil relies on a machine learning model for text classification. The pattern matching that identifies clusters of legal keywords (snippets) has a false-positive rate of about 80%, and the classifier is what tells genuine legal text apart from that noise. Everything Cavil does with a snippet after that — scoring it against the known licenses, and automatically folding, clearing or covering it in reports — builds on the classifier's judgement. Even a simple model identifies almost all of the false positives.

The openSUSE HuggingFace org has a collection of models fine-tuned specifically for this task, such as Cavil-Qwen3.5-4B, usually served with a llama.cpp server. See the setup guide for deployment instructions.

Getting Started

The easiest way to get started with Cavil is the included staging scripts for setting up a quick development environment. All you need is an empty PostgreSQL database (with the pgcrypto and pg_trgm extensions activated) and the following dependencies:

# Install dependencies
sudo zypper in -C postgresql-server postgresql-contrib
sudo zypper in -C perl-Mojolicious perl-Mojolicious-Plugin-Webpack \
  perl-Mojo-Pg perl-Minion perl-File-Unpack2 perl-HTML-Parser perl-Cpanel-JSON-XS \
  perl-Cavil-Matcher perl-Mojolicious-Plugin-OAuth2 perl-Mojo-JWT \
  perl-BSD-Resource perl-Term-ProgressBar perl-Text-Glob perl-IPC-Run \
  perl-Try-Tiny perl-MCP perl-CommonMark perl-CryptX git git-lfs tar xz \
  cpio rpm unzip binutils gzip bzip2 sharutils poppler-tools mkisofs \
  p7zip-full cabextract lzip file shared-mime-info
npm i

# Build JavaScript assets
npm run build

Then use these commands to set up and tear down a development environment:

# Initialize staging environment (remove --clean to include example fixtures)
perl staging/start.pl --clean postgresql://tester:testing@/test

# Start HTTP application server under http://127.0.0.1:3000
CAVIL_CONF=staging/do_not_commit/cavil.conf morbo script/cavil

# Start background job queue (separate process that does all the actual work)
CAVIL_CONF=staging/do_not_commit/cavil.conf script/cavil minion worker

# Tear down staging environment once you are done
perl staging/stop.pl

The staging environment has no real authentication, so the Login link signs you straight in as an admin. From there you can browse any example reports and upload a tarball of your own to get a first legal report. For a real instance, follow the setup guide instead.

Documentation

• Setup — setting up a fresh Cavil instance for production.
• Architecture — how the pieces fit together: components, the review workflow, pattern matching and SBOM generation.
• License Pattern Lifecycle — a plain-language guide, written for lawyers and reviewers, to how a piece of text becomes a reusable license pattern.

The documentation index has the full list, including the API reference, maintenance tasks and the contributor workflow.

Acknowledgements

Cavil bundles and builds upon license data from third parties, including the ScanCode LicenseDB (CC-BY-4.0), the SPDX License List, and the OSADL Open Source License Compliance Checklists (CC-BY-4.0), whose license compatibility matrix is surfaced per package in legal reports. See the NOTICE file for the full attributions and their licenses.