Earnie Review: Always-on Governance for AI-Written Code

As AI coding agents accelerate the pace of enterprise development, they also introduce a new compliance blind spot. A human developer might pause before copying a snippet with a restrictive license, but an AI agent has no awareness of a team’s license policy and no instinct to check. The result is a quiet accumulation of license obligations that can quickly become exposure at scale. SCANOSS’s Earnie is built to close that gap, offering continuous, deterministic governance that keeps up with the speed of AI-generated code.

Earnie is a major release of the SCANOSS software governance platform, designed for a world where code moves faster than manual review. It detects license obligations down to the individual snippet—not just the declared dependency—whether the code comes from a developer’s own commits, copied or vendored code, or an AI agent. For each component, it maps the applicable license and its obligations, generates attribution files, and maintains a versioned software bill of materials (SBOM) in open standards CycloneDX and SPDX. The result is a standing record of license posture, not a one-time report that goes stale.

What is Earnie?

Earnie is a continuous compliance programme organised around dated releases rather than point-in-time scans. It provides always-on governance for every line of code, regardless of its author. The platform checks code against a team’s policy at multiple points in the development workflow: before code is written (via the Model Context Protocol), at the keyboard (via CLI and pre-commit hooks), and at merge (via CI/CD integrations with GitHub and GitLab). Every finding is connected to a policy decision, and policy changes go through an approval step with a visible status, making every decision auditable.

Also worth a look: Deepen Calibrate Review: Targetless Multi-Sensor Calibration Made Easy and Triplett TEV300 Review: Fast, Reliable EV Charger Testing.

Detection relies on SCANOSS’s proprietary knowledge base of more than 188 million open source components and 3 trillion lines of fingerprinted code across 12 programming languages. No third-party data is used, and each customer operates in an isolated environment where source code never leaves their infrastructure—only fingerprints and hashes are shared for matching. This deterministic approach means the same input always produces the same result, giving teams results they can trust internally and that regulators can independently audit.

What stands out

Agent-native integration via MCP

Earnie integrates directly with coding agents through the Model Context Protocol (MCP). Before an agent adds a dependency, it can ask Earnie whether that component is allowed under the project’s policy and receive immediate guidance—pass, warn, or flag for review. This prevents violations before they even enter the codebase.

Pre-commit and CI/CD checks

At the keyboard, the CLI and pre-commit hook block commits that violate policy, surfacing the exact finding and evidence. On pull requests, Earnie posts clear comments with pass/warn signals, gating merges until policy is satisfied. This multi-stage approach ensures nothing slips through.

Deterministic, auditable evidence

Every finding is backed by a link to the source snippet, the license, and the policy rule that triggered it. Policy changes are recorded with approval status, creating a chain of custody that satisfies both internal trust and external audit requirements.

Always-on SBOM management

Earnie continuously updates a versioned SBOM in CycloneDX and SPDX formats, ready for export on demand. It can also import existing SBOMs, so teams don’t have to rebuild their inventory from zero. This gives a live picture of the license posture across the entire estate.

Who it’s for

Earnie is designed for enterprise development teams that rely on AI coding agents and need to enforce open source license policies at scale. It is equally valuable for compliance officers who require a clear, auditable record of every license decision. Organisations that have adopted AI-assisted development and worry about the compliance gap will find Earnie a natural fit. It also suits teams that manage large codebases with extensive open source dependencies and need to track obligations beyond declared packages.

What makes it worth considering

In a landscape where AI agents can commit code faster than any human review process, Earnie offers a governance layer that operates at the same speed. Its deterministic detection eliminates false positives and gives teams confidence that every finding is real. The ability to check policy before code is written, at commit, and at merge means no single point of failure. The auditable policy workflow ensures that even as rules evolve, every change is documented and approved. For teams already using SBOMs, the support for CycloneDX and SPDX means Earnie fits into existing compliance workflows without disruption. The isolated customer environment also addresses security concerns about sharing source code with a third party.

Verdict

Earnie is an essential governance layer for any team using AI coding agents. It delivers deterministic, auditable compliance at agent speed, integrating seamlessly into modern development workflows. For enterprises that value both speed and safety, Earnie is a compelling solution that turns a compliance blind spot into a managed, verifiable process.