Comply FAQs

Question 1

How does Comply handle monorepos and multi-repo environments?

Accepted Answer

Comply automatically detects and supports various monorepo structures (npm, pnpm, Lerna, Nx, Turborepo), scoping dependencies to their respective workspaces. For multi-repo environments, it offers a 'summary' command to roll up compliance data into a single, executive-level dashboard, ideal for org-wide visibility and due diligence.

Question 2

What programming ecosystems does Comply currently support?

Accepted Answer

Comply offers full support for npm/Node.js and Python. It also has partial support for Go and Rust, with plans to expand coverage to Java, Ruby, and .NET in the future. AI analysis is available across supported ecosystems.

Question 3

What types of reports does Comply generate?

Accepted Answer

Comply produces comprehensive reports including an Executive Summary for non-technical stakeholders, a Detailed Summary of dependencies, violation breakdowns with remediation steps, dependency health checks, license distribution, and drift analysis. It also generates machine-readable JSON reports and NOTICES/ATTRIBUTION files.

Question 4

What is Comply and how is its AI different from other compliance tools?

Accepted Answer

Comply is an AI-powered agent for open source license compliance that scans codebases and dependencies. Its unique AI analyzes *how* flagged packages are actually used, determining if specific usage context (e.g., distribution model, linking) truly triggers license obligations, offering a more precise risk assessment than tools that merely flag license presence.

Question 5

Can Comply integrate into a CI/CD pipeline?

Accepted Answer

Yes, Comply is designed for seamless CI/CD integration. It can be configured to fail builds based on specific violation thresholds (e.g., any, critical, high, or only *new* violations introduced since the last scan), enabling continuous compliance and preventing new issues from being merged.

Comply

Comply

主な機能

ユースケース

主な機能

ユースケース