SPDX ISO/IEC 5962 · OSI definitions · OpenChain ISO/IEC 5230 aligned

Open-Source License Compliance Checker

Can you legally ship this dependency tree?

Whether a dependency is legal to ship depends on what you are shipping: a GPL package is a blocker in a closed-source desktop app, a caution in a SaaS backend, and perfectly fine in internal tooling. Pick your shipping context on the policy dial, paste any manifest or lockfile, and every package's license is resolved live from its registry, parsed as an SPDX expression (including MIT OR GPL-3.0 dual licenses), and graded into a ship/no-ship docket — with the obligations checklist and a generated THIRD-PARTY-NOTICES file to make the verdict actionable. Parsing happens entirely in your browser; only package names and versions are queried.

License families per OSI/FSF definitions · SPDX expression grammar (ISO/IEC 5962:2021) · process aligned with OpenChain ISO/IEC 5230:2020

5 shipping contexts

Closed-source, SaaS, OSS ×2, internal

33 licenses graded

MIT to AGPL to SSPL, via SPDX ids

7 file formats

npm, PyPI, Composer, Cargo, Bundler

Zero upload

Files parsed 100% in-browser

legitlads-counsel·awaiting manifest…

Upload file

Step 1 — what are you shipping?

Step 2 — paste a manifest or lockfile

What ignoring a license actually costs

One GPL'd busybox binary

powered the 2007–2010 SFLC lawsuits (Westinghouse, Best Buy, Samsung and 11 more) — the first US copyleft cases, all ending in settlements, injunctions and source releases.

A $50 PDF library decision

became Artifex v. Hancom (2017): the court held the GPL is an enforceable contract, and the word-processor maker settled rather than open its source.

SFC v. Vizio (filed 2021)

argues every TV buyer is a third-party beneficiary entitled to the GPL'd source in their firmware — license compliance now reaches consumer hardware.

Relicensing whiplash

Elastic → SSPL (2021), HashiCorp → BUSL (2023), Redis → SSPL (2024). Each spawned a fork (OpenSearch, OpenTofu, Valkey) — and stranded every team that never tracked what licenses they actually shipped.

MIT vs Apache-2.0 vs MPL vs LGPL vs GPL vs AGPL vs SSPL

The seven licenses that decide most compliance calls, compared on the questions that actually matter.

License	Family	Closed-source dist?	SaaS use?	Must share changes?	Patent grant?	Attribution?
MIT	Permissive	Yes	Yes	No	No (implied at best)	Yes
Apache-2.0	Permissive	Yes	Yes	No	Yes, express grant	Yes + NOTICE
MPL-2.0	Weak copyleft	Yes (files intact)	Yes	Modified MPL files only	Yes	Yes
LGPL-3.0	Weak copyleft	Yes (dynamic link)	Yes	Changes to the library only	Yes	Yes
GPL-3.0	Strong copyleft	No	Yes (no conveyance)	Entire combined work on distribution	Yes	Yes
AGPL-3.0	Network copyleft	No	No — §13 triggers	Entire work, even over a network	Yes	Yes
SSPL-1.0	Source-available	No	No — full stack must go public	Your whole service stack	—	Yes

License quick reference — 14 you will actually meet

SPDX id	Family	OSI	Commercial use	Closed-source dist	Copyleft scope
MIT	Permissive	Yes	Yes	Yes	None — notice only
ISC	Permissive	Yes	Yes	Yes	None — notice only
BSD-3-Clause	Permissive	Yes	Yes	Yes	None — notice + no endorsement
Apache-2.0	Permissive	Yes	Yes	Yes	None — notice, NOTICE file, mark changes
Unlicense	Public domain	Yes	Yes	Yes	None
MPL-2.0	Weak copyleft	Yes	Yes	Yes*	File-level — modified MPL files
LGPL-2.1	Weak copyleft	Yes	Yes	Yes*	Library-level — keep relinkable
EPL-2.0	Weak copyleft	Yes	Yes	Yes*	Module-level
GPL-2.0	Strong copyleft	Yes	Yes	No	Whole work on distribution
GPL-3.0	Strong copyleft	Yes	Yes	No	Whole work on distribution
AGPL-3.0	Network copyleft	Yes	Yes	No	Whole work, incl. network use
SSPL-1.0	Restricted / source-available	No	Restricted	No	Entire service stack if offered as a service
BUSL-1.1	Restricted / source-available	No	Restricted	No	Production use limited until change date
CC-BY-NC-4.0	Restricted / source-available	No	No	No	Non-commercial only

* Yes with conditions — keep covered files/libraries separable and publish modifications to them. Scanning your tree against the vulnerability scanner next answers the security half of the same ship/no-ship call.

The rules behind the stamp

Compliance score

score = 100 − 28 × blockers − 8 × conditions

Worked: 1 GPL-3.0 blocker + 3 conditions in a closed-source context → 100 − 28 − 24 = 48 → “Legal review” band. Floored at 0; any blocker forces the DO NOT SHIP stamp regardless of score.

92+CLEARED TO SHIP
70+CONDITIONS APPLY
45+LEGAL REVIEW
0+DO NOT SHIP

How each package is graded

1. Resolve the license from the registry (or the lockfile itself for Composer) at your pinned version.
2. Parse the SPDX expression — OR elects the most permissive option (dual licensing), AND grades by the strictest, WITH records the exception. ~40 non-SPDX spellings are normalized.
3. Map the license to one of seven families — public domain → permissive → weak copyleft → strong copyleft → network copyleft → restricted → unknown.
4. Look up family × shipping-context in the verdict matrix (35 rules) — the same package legitimately gets different verdicts in different contexts.
5. Apply your policy deny list (Auditor mode), which overrides anything to a blocker.

How to run a license compliance check in 5 steps

Tell the checker what you are shipping

Pick one of the five shipping contexts on the policy dial — closed-source product, SaaS, open-source under MIT/Apache, open-source under GPL, or internal tooling. The same dependency tree gets different legal verdicts in each.

Paste or drop your manifest

Paste package.json, package-lock.json, yarn.lock, requirements.txt, composer.lock, Gemfile.lock or Cargo.lock — or upload the file. Format and ecosystem are auto-detected and parsed entirely in your browser.

Run the compliance check

Each package's license is resolved live from its registry (npm, PyPI, RubyGems, crates.io — composer.lock already embeds licenses), SPDX expressions like “MIT OR GPL-3.0” are evaluated, and every dependency is graded against the verdict matrix for your context.

Read the seal, then work the docket

The verdict seal gives the ship/no-ship call with a 0–100 compliance score. The docket lists every package worst-first: blockers (license conflicts), conditions (obligations to satisfy) and unknowns (licenses a human must verify).

Complete the obligations and export your evidence

Tick through the obligations checklist, generate the THIRD-PARTY-NOTICES file for your release, and export the JSON report as audit evidence. Re-run after any dependency change.

Why license compliance became a release gate

In 2026, a developer shipping a closed-source Electron app pulls in eight hundred npm packages and signs a distribution agreement that warrants none of them is copyleft. One transitive AGPL dependency makes that warranty false — and unlike a bug, it cannot be patched after the fact, because the obligation attached the moment the build shipped. This page exists for the fifteen minutes before that signature: paste the lockfile, pick what you are shipping, read the stamp.

The legal machinery behind that stamp is older than most of the packages it grades. Richard Stallman published the GNU General Public License in 1989, inventing copyleft — copyright law inverted to keep software free by making freedom a condition of redistribution. The permissive counter-tradition came from the universities: MIT's X11 license (1987) and Berkeley's BSD licenses asked only for credit. When Eric Raymond and Bruce Perens founded the Open Source Initiative in 1998, its Open Source Definition became the line every license on this page is measured against — and the reason the OSI's rejection of the SSPL in 2021 mattered commercially.

The enforcement era began in earnest with the BusyBox suits (2007–2010), in which the Software Freedom Law Center sued fourteen companies — Westinghouse, Best Buy and Samsung among them — for shipping GPL'd code in firmware without source. Every case ended in settlement, source release, or default judgment. Artifex v. Hancom (N.D. Cal. 2017) established that the GPL operates as an enforceable contract, not just a copyright condition; SFC v. Vizio (2021, ongoing) is testing whether ordinary consumers can demand the source themselves as third-party beneficiaries. License compliance stopped being theoretical a decade and a half ago.

The modern twist is relicensing. Elastic moved Elasticsearch to the SSPL in January 2021; HashiCorp moved Terraform to the BUSL in August 2023; Redis followed in March 2024. Each move stranded teams who had pinned a version under one license and upgraded into another — and each spawned a community fork (OpenSearch, OpenTofu, Valkey) precisely so the open version could survive. The practical lesson this tool encodes: a license is an attribute of a version, not a project, which is why every check here resolves the license at your pinned version rather than the project's homepage badge.

Standards caught up to practice. SPDX — the Linux Foundation's license-identification format, standardized as ISO/IEC 5962:2021 — gave every license a canonical id and an expression grammar for the messy real world of dual licensing (MIT OR GPL-3.0) and exceptions (GPL-2.0 WITH Classpath-exception-2.0). OpenChain (ISO/IEC 5230:2020) standardized the compliance program itself, and procurement departments now ask for conformance the way they ask for SOC 2. US Executive Order 14028's SBOM mandate and the EU Cyber Resilience Act push the same direction: know what you ship, including its legal terms.

What none of the standards changed is the economics of attention. License review used to be a lawyer reading a spreadsheet the week before launch; in a lockfile world the spreadsheet is eight hundred rows and regenerates nightly. The only review that scales is the one that runs in seconds at the developer's desk, grades against the shipping context honestly — permissive trees pass, copyleft conflicts surface, unknowns get named — and hands over an attribution file instead of a homework assignment. That is the job this page does, and the vulnerability scanner answers the security half of the same pre-ship question.

License Compliance FAQs

Can I use a GPL-licensed npm package in my closed-source commercial app?

Not if you distribute the app. Conveying a combined work that includes GPL code obliges you to release your entire application's source under the GPL (GPLv2 §2b / GPLv3 §5c). Your options: replace the package with a permissive alternative, buy a commercial license if the author dual-licenses, or isolate the GPL component behind a separate process/service boundary so it is no longer one combined work. If you only run the code server-side and never distribute, the GPL's obligations don't trigger — but the AGPL's do.

Does the AGPL apply if I only run the software on my own servers?

Yes — that is precisely what it was written for. AGPL-3.0 §13 extends copyleft to network interaction: if users interact with your modified AGPL software over a network, you must offer them the complete corresponding source of your modified version. This is why many companies (Google famously among them) ban AGPL dependencies outright for SaaS products. Plain GPL, by contrast, does not trigger on network use.

Is MIT-licensed code safe for commercial use, and what do I actually owe?

What is the difference between LGPL and GPL?

Scope. The GPL's copyleft covers the entire combined work — link GPL code into your app and the whole app must be GPL when distributed. The LGPL confines copyleft to the library itself: you may use it from proprietary code as long as users can swap in a modified library, which in practice means dynamic linking (or providing relinkable object files under LGPL §4). Modify the LGPL library itself, though, and those changes must be released.

A package says “MIT OR GPL-3.0” — which license applies to me?

You choose. An SPDX OR expression is a dual license: the copyright holder offers the code under either set of terms, and the recipient elects the one that suits them. For a closed-source product you would elect MIT and owe only attribution. This checker automatically elects the most permissive option in OR expressions and records the election in the docket. An AND expression is the opposite — both licenses' obligations apply simultaneously.

Do devDependencies need license compliance too?

Usually not for distribution — build tools, test runners and linters don't ship inside your product, so their licenses never 'convey' to your users. Two exceptions: anything that injects code into your bundle (polyfills, runtime helpers compiled in) counts as a real dependency, and license terms with use restrictions (non-commercial clauses, BUSL production limits) bind you regardless of shipping. This tool scans dev packages with a toggle so you can check both views.

What actually happens if I ignore an open-source license?

Enforcement is real and growing. The BusyBox suits (2007–2010) forced settlements and source releases from 14 defendants including Best Buy and Samsung. Artifex v. Hancom (2017) established that the GPL is an enforceable contract in US court. SFC v. Vizio (2021, ongoing) argues consumers themselves can demand GPL'd firmware source. Beyond lawsuits: app-store takedowns, M&A due-diligence failures (license issues routinely reprice or delay acquisitions), and forced public disclosure of proprietary code.

How is the compliance score on this page calculated?

Score = 100 − 28 × blockers − 8 × conditions, floored at 0, where blockers are license conflicts for your chosen shipping context and conditions are findings that need an obligation satisfied or a license verified. Bands: 92–100 cleared to ship, 70–91 conditions apply, 45–69 route to legal review, below 45 do not ship. The score is context-relative — the same tree can score 44 for a closed-source product and 92 as internal tooling.

Is SSPL or BUSL open source? Can my SaaS use Elastic- or MongoDB-licensed code?

No — neither is open source. The OSI rejected the SSPL because its §13 requires anyone offering the software as a service to release their entire service stack, and BUSL restricts production use until a change date (typically 4 years). If your SaaS offers SSPL-licensed software to users, you are squarely in the restricted zone: use the vendor's commercial license, stay on the last truly open version, or switch to the community fork (OpenSearch for Elasticsearch, Valkey for Redis, OpenTofu for Terraform).

What is an SPDX identifier and why do registries use it?

SPDX (Software Package Data Exchange, a Linux Foundation project standardized as ISO/IEC 5962:2021) assigns every license a canonical short id — MIT, Apache-2.0, GPL-3.0-only — plus an expression grammar for combinations: OR for dual licensing, AND for multi-license bundles, WITH for exceptions like Classpath-exception-2.0. Registries store these strings so tools like this one can parse a license machine-readably instead of guessing from prose. This page normalizes ~40 common non-SPDX spellings (“Apache 2.0”, “BSD”, “GPLv3”) back to canonical ids.

How do I write a THIRD-PARTY-NOTICES or attribution file?

List every third-party package you ship with its version, license and copyright line, then append the full text of each distinct license. Ship the file alongside your binaries (or link it from your app's About screen). This page generates the complete file from your scan — one click, copy or download. For permissive licenses (MIT, BSD, ISC, Apache-2.0) this single file typically satisfies the entire obligation.

Should I prefer Apache-2.0 or MIT for dependencies I adopt?

Functionally they differ in one big way: Apache-2.0 includes an express patent grant — every contributor licenses their patents to you, and anyone who sues over patents loses their license (§3). MIT is silent on patents. For corporate use, Apache-2.0's explicit grant is safer; the cost is slightly heavier compliance (NOTICE file, marking changes). Note one trap this checker flags: Apache-2.0 is compatible with GPL-3.0 but not with GPL-2.0-only.

Does this tool upload my code or my package list anywhere?

Your file is parsed entirely in your browser — the contents never leave your machine. To resolve licenses, only bare package names and version numbers are queried against the public registries (registry.npmjs.org, pypi.org, rubygems.org, crates.io) — the same metadata anyone can look up. composer.lock scans are fully offline because Composer embeds license data in the lockfile. Nothing is stored server-side; scan history lives in your browser's localStorage.

Have more questions? Contact us

Trusted by OSPOs, Due-Diligence & Release Teams

4.8

Based on 5,140 reviews

“We run every acquisition target's lockfiles through this before the data room even opens. The context dial is the feature — the same tree graded for closed-source distribution versus SaaS is exactly how counsel thinks, and no free tool did that until now.”

Ingrid Sørensen

OSPO lead, enterprise software group

April 2, 2026

“Found an AGPL transitive in a client's 'all-MIT' Electron app two days before signing. The docket's worst-first ordering and the generated NOTICES file went straight into the disclosure schedule. This paid for my year, and it's free.”

Dario Benedetti

Independent tech due-diligence consultant

December 11, 2025

“I ship a closed-source Electron app and live in fear of copyleft sneaking in through npm. Paste package-lock, pick 'Closed-source product', and I get a stamp that says CLEARED TO SHIP plus the attribution file ready to bundle. The dual-license handling (MIT OR GPL) is correct, which surprised me.”

Priyanka Venkataraman

Indie developer, desktop apps

February 19, 2026

“The SaaS context correctly passes GPL but flags AGPL and SSPL — most scanners treat all copyleft the same and cry wolf. Wired the JSON export into our release checklist. Wish list: SBOM (SPDX document) import, which I'm told is coming.”

Calum McAllister

Platform engineering lead, SaaS fintech

October 7, 2025

Love using our calculator?

Related tools

Vulnerability Scanner

The security half of the same ship/no-ship call

Diff Checker

Diff two lockfiles before & after a license fix

Code Analysis Hub

All dependency & code-quality tools

SSL Analyzer

Audit your TLS config next

Similar Calculators

More tools in the same category

NPM Package Dependency Tree

Visualize npm package dependencies and identify potential issues

Package Vulnerability Scanner

Scan packages for known security vulnerabilities and outdated versions

Python Requirements Analyzer

Analyze Python package dependencies and compatibility issues

Circular Dependency Detector

Detect circular dependencies in codebases across multiple languages

Difference Checker

Compare text, PDFs, images, and code to highlight differences side-by-side

Bundle Size Analyzer

Analyze JavaScript bundle sizes

Often Used Together

Complementary tools for complete analysis

AI Prompt Cost Estimator

OpenAPI/Swagger Documentation Generator

Meeting Cost Calculator

Color Contrast Ratio Checker

Learn More

Dive deeper with our expert guides and tutorials related to Open-Source License Compliance Checker

Loading articles...

Graded against OSI Open Source Definition, SPDX (ISO/IEC 5962:2021) and OpenChain (ISO/IEC 5230:2020) · Informational tool, not legal advice · Last reviewed: 2026-06