spdx-tools
SPDX parser and tools.
Decision gist · record as of 2026-08-14
Yes. spdx-tools is the reference implementation of the SPDX specification in Python, actively maintained, production-stable, and has no known vulnerabilities. Install it if you need to work with SPDX documents—parsing, validation, or creation. The only caveat is that SPDX 3.0 support is experimental and not recommended for production; stick to v2.2/v2.3 for stable use.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python 3.10 or later.
- Low friction install with a wheel distribution.
- Active maintenance (last commit 2026-03-13) and production-stable status.
License · maintenance · safety
Apache-2.0 (permissive) — Apache-2.0 permissive license allows use in most commercial and open-source projects without significant restrictions, though you must include the license text and notice of modifications.
last release 2026-03-13 (154 days) · last repo commit 2026-03-13 · 254 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 5,435,206 downloads/mo, #2,101 on PyPI
Alternatives
Verify before relying
pip install spdx-tools
from spdx_tools.spdx.parser.parse_anything import parse_file
from spdx_tools.spdx.writer.write_anything import write_file
document = parse_file('input.spdx.json')
write_file(document, 'output.spdx.tag')- Whether SPDX 3.0 experimental support is suitable for production use despite the documentation's caution against it.
- Performance characteristics when parsing or validating very large SPDX documents.
- Whether optional graph generation dependencies (networkx, pygraphviz) are easy to install on all platforms.
What it is and what it does
spdx-tools is a Python library that implements the full SPDX (Software Package Data Exchange) specification for documenting software licenses, components, and compliance metadata. It lets you read SPDX documents in five standard formats, validate them against the v2.2 or v2.3 specification, manipulate their structure programmatically via a typed dataclass model, and write them back out in any supported format. The library also provides a command-line tool for batch parsing, validation, and format conversion.
The package is built on a strict type-checked data model where each SPDX object is a dataclass with enforced property types, catching invalid documents early. It includes experimental support for the upcoming SPDX v3.0 specification (write-only, not yet production-ready), and optional graph visualization of document structure. Nine runtime dependencies handle parsing (ply, xmltodict, rdflib), validation (beartype, semantic_version), and license expression evaluation (license_expression).
Use it for
- Generate or validate software bill of materials (SBOM) documents for compliance and supply-chain auditing.
- Convert SPDX documents between formats (e.g., JSON to RDF) for integration with different toolchains.
- Programmatically create SPDX v2.2/v2.3 documents from your build system or package metadata.
- Validate third-party SPDX files before ingesting them into a license compliance workflow.
- Parse and extract license and component information from SPDX documents for reporting or analysis.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes.
spdx-tools is the reference implementation of the SPDX specification in Python, actively maintained, production-stable, and has no known vulnerabilities. Install it if you need to work with SPDX documents—parsing, validation, or creation. The only caveat is that SPDX 3.0 support is experimental and not recommended for production; stick to v2.2/v2.3 for stable use.
Install
spdx-tools on PyPI
Before you install
Low friction install with a wheel distribution. Active maintenance (last commit 2026-03-13) and production-stable status. Nine runtime dependencies are all established libraries (beartype, click, pyyaml, rdflib, etc.), suggesting a well-integrated ecosystem with no exotic requirements.
Requires Python 3.10 or later.
License in practice
Apache-2.0 permissive license allows use in most commercial and open-source projects without significant restrictions, though you must include the license text and notice of modifications.
Quickstart
pip install spdx-tools
from spdx_tools.spdx.parser.parse_anything import parse_file
from spdx_tools.spdx.writer.write_anything import write_file
document = parse_file('input.spdx.json')
write_file(document, 'output.spdx.tag')Verify before relying
- Whether SPDX 3.0 experimental support is suitable for production use despite the documentation's caution against it.
- Performance characteristics when parsing or validating very large SPDX documents.
- Whether optional graph generation dependencies (networkx, pygraphviz) are easy to install on all platforms.
Package facts
| License | Apache-2.0 permissive |
| Python support | Supports the current Python release >=3.10 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 9 packagesbeartypeclicklicense_expressionplypyyamlrdflibsemantic_versionuritoolsxmltodict |
| Maintenance | Actively maintained 154 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 5,435,206 / month, #2,101 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 5 - Production/StableIntended Audience :: DevelopersIntended Audience :: System AdministratorsOperating System :: OS IndependentProgramming Language :: Python :: 3Programming Language :: Python :: 3 :: OnlyProgramming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.14Topic :: Software Development :: DocumentationTopic :: Software Development :: Libraries :: Python ModulesTopic :: Utilities |
Evidence: spdx_tools-0.8.5-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “SPDX document parser”
- spdx-toolsParse, validate, create, and convert SPDX software license documents…
- pyspdxValidates and tokenizes SPDX license expressions according to the…
- spdx3-validateValidates SPDX 3 documents with context-aware checks for external…
Give your agent the search over MCP, or paste the wish link into any chat.
More Python Modules packages
Converts domain names between Unicode and ASCII-compatible encoding (Punycode) according to IDNA 2008 and Unicode Technical Standard 46, with security validation and broader script coverage than the standard library.
Install it if you work with internationalized domain names, need to validate domains, or use HTTP clients that depend on it transitively.
Setuptools is a Python build backend and package management tool that handles building, distributing, and installing Python packages, including support for C/C++ extension modules.
PyYAML parses and emits YAML 1.1 data format, enabling serialization and deserialization of configuration files and Python objects to and from human-readable YAML text.
Pydantic validates Python data structures against type hints, coercing and checking input at runtime to ensure it matches a declared schema.
Provides reusable metadata objects for use with PEP-593 `typing.Annotated` to express common constraints like bounds, collection sizes, and predicates on types.
Install it if you use or build libraries that need to express type constraints in a standardized, inspectable way—or if you want to annotate your own types with…
Provides runtime tools to inspect and introspect Python type annotations, enabling programmatic examination of type hints at execution time.
See also pyspdx · spdx3-validate · spdx-python-model · license-expression · csaf-tool · lib4sbom · distro2sbom · reuse · pyshacl · pip-requirements-parser