License Compliance Scan
Spot license conflicts in your dependency tree before they become a problem. Read-only and advisory — it flags risks, it doesn't change anything, and it is not legal advice.
Prerequisites
- None. Pure Claude Code — reads dependency manifests and your
LICENSE directly, no MCP required.
Trigger
- "Check my dependency licenses"
- "Any license conflicts in this project?"
- "License compliance scan"
Workflow
- Identify the project's own license (from
LICENSE/package.json/pyproject.toml, etc.).
- Read dependency manifests present:
package.json, requirements.txt/pyproject.toml, go.mod, Cargo.toml, Gemfile, pom.xml, etc. List declared dependencies and, where stated, their licenses.
- Compare each dependency's license against the project's and report
file:line (the manifest entry), severity, and the obligation.
What to flag
| Finding |
Why it matters |
| Strong copyleft in a permissive project |
GPL/AGPL deps in an MIT/Apache project can impose source-disclosure obligations |
| Network copyleft (AGPL) |
Obligations can trigger even for hosted/SaaS use |
| Unknown / missing license |
A dependency with no clear license is a legal risk by default |
| License changed across versions |
A pinned upgrade may pull in new obligations |
| Project itself missing a LICENSE |
Others can't legally reuse it; flag if absent |
| Incompatible combinations |
Two dependency licenses that can't be combined for distribution |
- Output an advisory report:
## License Compliance Scan
Project license: Apache-2.0
**1 high, 1 unknown**
### HIGH
- package.json:21 — "some-gpl-lib" is GPL-3.0; combining it with an Apache-2.0
distribution may impose source-disclosure obligations. Review or replace.
### UNKNOWN
- requirements.txt:8 — "obscure-pkg" declares no license. Treat as all-rights-
reserved until clarified.
Note: advisory only, not legal advice — confirm obligations with counsel.
Diagnostic only. Want dependency and license checks in your CI gate? See QualityMax — qualitymax.io
