Can you ship these dependencies under your license?

Can you actually ship these dependencies?

Paste the declared licenses of your dependency tree and choose how you ship. You get the dependencies that conflict, the ones that need a human, and the usual way out of each — a GPL library in a closed-source app, Apache-2.0 code in a GPL-2.0-only project, an AGPL or SSPL component behind a hosted service, a package with no license at all.

Nothing is uploaded. The text you paste is parsed in this browser and never leaves your device.

1. How do you ship, and what do you depend on?

How you ship

Libraries are dynamically linked (matters for LGPL) I modify copyleft dependencies I run (matters for AGPL)

Dependencies (JSON array of name/version/license, pip-licenses JSON, or CSV) Already cleared by you or counsel (comma-separated names, optional)

2. Result

Package	License	Verdict	Why, and the usual fix

Prefer a CLI, or want this as a CI gate?

Same rules, zero dependencies, one file besides the engine. It can read your local node_modules directly (a browser cannot read your filesystem):

node cli.mjs scan --out deps.json
node cli.mjs check deps.json --project proprietary-distributed     # exit 1 on any conflict
node cli.mjs check deps.json --project saas --modified --strict    # reviews fail too
node cli.mjs check deps.json --project gpl-3.0-or-later --json
node cli.mjs notices deps.json > THIRD_PARTY_NOTICES.txt

Get cli.mjs and engine.mjs — Node 18+, nothing to install. Local files only: no network call, ever. Python: pip-licenses --format=json output is read as-is.

Cases this catches

Case	Why it matters

Read: can I use a GPL dependency in a closed-source app? Related: License Drift Check tells you when a dependency's license changed between two snapshots — run it alongside this one.

Common questions

Can I use a GPL dependency in a closed-source app?

Not if you distribute it. GPL and AGPL require the whole combined work to be released under the same license when you hand it to others. Running GPL software on your own servers without distributing it is a different case, and a separate program talking to yours over a pipe or socket is usually treated as arm's length. This tool flags the first case and notes the others.

What changes for a SaaS?

Copyleft such as GPL is triggered by distribution, which a hosted service does not do, so GPL dependencies are usually fine there. AGPL adds a network clause for modified versions, and SSPL requires releasing the surrounding service stack if you offer the software as a service.

Is this legal advice?

No. It encodes widely published FSF and OSI compatibility positions as a rules table so you can skim a large tree. Whether a rule applies to your facts, your linking and your contracts is a question for you or your counsel.

Is my dependency list uploaded anywhere?

No. The page parses what you paste in your own browser. The CLI reads local files only and makes no network call.