Cavil is a legal review and Software Bill of Materials (SBOM) system. It is used in the development of openSUSE Tumbleweed, openSUSE Leap, as well as SUSE Linux Enterprise.

Important: Note that most of the data used by Cavil has been curated by lawyers, but the generated reports do not count as legal advice and no guarantees are made for their correctness!

• Source code legal review for RPMs, DEBs, tarballs and various other package formats
• High performance scanner with recursive decompression of almost any archive format
• 28.000 curated patterns for 2000 license combinations with 500 distinct SPDX expressions
• Detection of vendored/bundled subcomponents (npm, Cargo, PyPI, Maven, Go, Composer, NuGet, RubyGems) shipped inside packages, surfaced in the SBOM and the review report

• Software Bill of Materials (SBOM) generation in SPDX 3.0.1 format, for the EU Cyber Resilience Act (CRA) as specified by BSI TR-03183-2, and satisfying the CISA minimum elements on top of it wherever the two do not conflict - see standards and coverage for the four things that are not covered yet, and why
• Package and component (purl) search, plus a component export, for supply-chain and vulnerability triage

• Legal risk assessments by lawyers for every pattern match
• Human reviews with approval/rejection workflow, and optional automatic approvals based on risk
• Machine learning text classification of snippets, which drives Cavil's automated resolution of scanner noise

• MCP support for integration into AI assisted legal review workflows
• REST API for integration into existing source code management systems
• Open Build Service and Gitea integration via bots
• Direct tarball upload, for one-off analysis without any bot integration
• OpenID Connect (OAuth 2.0) authentication

Cavil relies on a machine learning model for text classification. The pattern matching that identifies clusters of legal keywords (snippets) has a false-positive rate of about 80%, and the classifier is what tells genuine legal text apart from that noise. Everything Cavil does with a snippet after that - scoring it against the known licenses, and automatically folding, clearing or covering it in reports - builds on the classifier's judgement. Even a simple model identifies almost all of the false positives.

The openSUSE HuggingFace org has a collection of models fine-tuned specifically for this task, such as Cavil-Qwen3.5-4B, usually served with a llama.cpp server. See the setup guide for deployment instructions.

To set up Cavil, follow the setup guide. Its quick start with Docker gets you a working instance with a few commands, and the rest of the guide covers installing directly on a host. Either way, Cavil needs the AI classifier described there.

To work on Cavil itself, the development guide sets up a local environment with example data.

• Setup - setting up a fresh Cavil instance for production.
• Architecture - how the pieces fit together: components, the review workflow, pattern matching and SBOM generation.
• License Pattern Lifecycle - a plain-language guide, written for lawyers and reviewers, to how a piece of text becomes a reusable license pattern.

The documentation index has the full list, including the API reference, maintenance tasks and the contributor workflow.

Cavil bundles and builds upon license data from third parties, including the ScanCode LicenseDB (CC-BY-4.0), the SPDX License List, and the OSADL Open Source License Compliance Checklists (CC-BY-4.0), whose license compatibility matrix is surfaced per package in legal reports. See the NOTICE file for the full attributions and their licenses.