Package license definitions

Clearly Defined maintains a definition for each open source package covering its declared license, source location, and other identifying data pulled from registries such as npm or PyPI. A Beam agent looks up a package's definition when a dependency is added or reviewed, reading the declared license against an approved policy, such as a list of licenses cleared for use. Packages that match the policy are logged as cleared. Packages with an unclear, missing, or disallowed license are routed to a person to review before the dependency is approved.

Community curations

Community members can submit curations to Clearly Defined that correct or fill in gaps in a package's definition, such as a license the automated harvest missed. A Beam agent checks whether a package has an open or accepted curation before treating its definition as final, reading the curation status alongside the underlying data. Where an approved rule allows it, the agent applies the curated value directly. Packages with a pending curation, or a curation that conflicts with the harvested data, are routed to a person to confirm before the record is used.

Source and security metadata

Alongside license data, Clearly Defined records source location and basic security signals harvested from a package's origin, such as where the code is hosted and how it was scanned. A Beam agent reads these details when assessing a new or updated dependency, applying an approved rule such as requiring a known source location before approval. Packages that meet the rule are marked cleared in the review record. Packages with an unrecognized source, missing harvest data, or unresolved discrepancies are routed to a person for manual review.