Open-source license review checklist
Triage the licences in your dependencies, prompts and assets by how you distribute your product, and know which ones need a closer look.
Fill in your details
Values are inserted into every prompt below. Nothing you type leaves your browser.
2 field(s) left — unfilled variables stay as {{placeholders}}.
1Know how you distribute
Obligations usually depend on distribution. ☐ Internal use only. ☐ SaaS: users access it over a network but don't receive the code. ☐ Distributed: you ship binaries, apps, containers, firmware or libraries to others. Network-use clauses (e.g. AGPL) can apply to SaaS; most copyleft obligations are triggered by distribution.
2Sort licences into families
Permissive (MIT, BSD-2/3-Clause, ISC, Apache-2.0): keep copyright and licence notices; Apache-2.0 also includes a patent licence and requires preserving NOTICE files and stating changes. Weak copyleft (LGPL, MPL-2.0, EPL-2.0): changes to the licensed files or library must be shared under the same licence; linking rules vary. Strong copyleft (GPL-2.0, GPL-3.0): distributing a combined work may require releasing your source under the GPL. Network copyleft (AGPL-3.0): offering modified software over a network can trigger source-sharing. Source-available, not open source (e.g. BSL, SSPL, 'Commons Clause' additions): read the specific restrictions. No licence: you have no permission to use it; treat as blocked. Content (CC BY, CC BY-SA, CC BY-NC): for prompts, images and docs; NC means no commercial use, SA means share-alike.
3Run the checks
☐ Generate an inventory with a licence scanner or SBOM tool, including transitive dependencies. ☐ Flag anything copyleft, source-available, unknown or 'custom'. ☐ Check that the licence in the package metadata matches the LICENSE file in the repository. ☐ Include non-code assets: fonts, icons, images, datasets, prompts and AI-model licences. ☐ Produce attribution/NOTICE output for shipped products. ☐ Record decisions (approved, replaced, exception) with date and reviewer.
4AI-assisted triage
Use AI to triage and draft questions, never as the final word.
Triage these dependency licences for our product. How we distribute: {{distribution_model}} Dependencies (name, version, licence as reported): {{dependency_list}} Output a table: Dependency | Licence | Family (permissive / weak copyleft / strong copyleft / network copyleft / source-available / unknown) | Likely obligation for our distribution model | Risk (Low / Review / High) | Suggested action. Treat missing or unusual licence identifiers as "unknown" and flag them for review. Then list the questions we should ask a lawyer about the High and Review items. Do not state that anything is definitely compliant.
Example input
SaaS plus a distributed desktop app; dependencies include an AGPL-licensed PDF library and one package with no licence.
Example output
| ghostscript | AGPL-3.0 | Network copyleft | Bundling it in the distributed desktop app and the SaaS backend may require releasing corresponding source | High | Isolate as a separate process, buy a commercial licence, or replace | | some-lib | UNKNOWN | Unknown | No permission confirmed | High | Check the repository; contact the author or replace | | sharp | Apache-2.0 | Permissive | Keep licence and NOTICE in attribution | Low | Include in NOTICE output | Questions for counsel: Does running the AGPL library as a separate process change our obligations for the desktop app?
Troubleshooting
- Scanner reports 'NOASSERTION' or 'UNKNOWN': check the package's repository manually; these are common for older packages.
Known limitations
- This is not legal advice. Licence interpretation depends on facts and jurisdiction; consult a qualified lawyer for High items.
- Licence metadata in package registries is sometimes wrong or incomplete.