Why it matters
Every dependency comes with a licence, and most are permissive: keep the notice and you're done. The ones that matter are copyleft and source-available licences, because what they ask depends on your own licence and on how the code reaches people. GPL code inside an app you distribute can mean releasing your source; the same code on your own servers usually doesn't, unless it's AGPL.
This checker reads the licence field for every package in a lockfile or SBOM, parses it as an SPDX expression and judges it against the licence and shipping model you choose. Where a package offers a choice (OR), it takes the option that suits you; where several licences apply (AND), the strictest counts. It's a guide to the common cases, not legal advice.
How to use it
- Paste or drop your package-lock.json, composer.lock or SBOM.
- Choose your project's licence and how you ship it.
- Read the conflicts and packages to check first.
- Download the CSV for your records or your legal team.
FAQ
Where do I get a file with licences in it?
package-lock.json from npm 7 or later has a licence for each package. You can also run npm sbom --sbom-format cyclonedx, or use composer.lock for PHP, or an SPDX or CycloneDX SBOM from tools like Syft.
Why does SaaS change the verdict?
The GPL's conditions are triggered by distributing the software. Running it on your own servers isn't distribution, so GPL code there doesn't oblige you to release your source. The AGPL closes that gap for network use.
What does OR mean in a licence?
That you can choose either licence. For MIT OR GPL-3.0-or-later you can take MIT, so the checker judges the option that suits you best.
Is this legal advice?
No. It covers widely accepted interpretations, such as the FSF's compatibility list, but how code is linked and modified matters. Ask a lawyer about anything flagged as a conflict.
Is my lockfile uploaded?
No. It's read and checked in your browser.
