licensegate

npm licences, checked by how you ship

AGPL matters for a SaaS, GPL matters for an app people download. licensegate reads your whole dependency tree and tells you which packages conflict with your way of shipping.

npx -y https://licensegate.org/dl/licensegate.tgz --mode saas --prod

Install Read the guides

--mode

licensegate 0.4.1 · mode saasdistributedlibraryinternal · production only · 9 packages from package-lock.json

  • my-app@1.0.0
  • express@4.21.2MITokokokok
  • body-parser@1.20.3MITokokokok
  • react@18.3.1MITokokokok
  • some-db-driver@2.0.0AGPL-3.0-onlyBLOCKBLOCKBLOCKok
  • rich-editor@3.1.0GPL-3.0-onlyokBLOCKBLOCKok
  • media-codec@0.9.4LGPL-2.1-or-laterokREVIEWREVIEWok
  • fancy-chart@1.4.2CC-BY-NC-4.0REVIEWREVIEWREVIEWREVIEW
  • geo-utils@1.2.0MPL-2.0okREVIEWREVIEWok
  • tiny-parser@2.3.0MIT OR GPL-3.0okokokok

7 ok · 1 to review · 1 blocking4 ok · 3 to review · 2 blocking4 ok · 3 to review · 2 blocking8 ok · 1 to review · 0 blocking

The same 9 packages, judged for each way of shipping. In a terminal licensegate prints the review and block lines and the totals; --json lists every package with its verdict.

Why the way you ship changes the answer

You ship…--modeAGPLGPLLGPL / MPLNon-commercial
A hosted web app or APIsaasblockokokreview
An app people download (desktop, mobile, Electron, on-prem)distributedblockblockreviewreview
A package other people installlibraryblockblockreviewreview
Internal tools onlyinternalokokokreview

A list of licence names, which is what most checkers print, doesn't tell you which of them is a problem. A GPL package is usually fine on a server you run yourself. The same package can become a problem when you ship a desktop app. licensegate applies that rule to every package, including the ones you never installed directly.

What it does

  • Works with npm, pnpm, yarn and bun: reads package-lock.json or the installed node_modules, and tells production dependencies from dev ones.
  • Resolves SPDX expressions: MIT OR GPL-3.0 means you pick MIT. Handles WITH exceptions, old licenses arrays and loose names.
  • When package.json says SEE LICENSE IN… or nothing, it reads the package’s LICENSE text.
  • Exit code 1 in CI when something blocks your mode. --allow clears a package you have checked.
  • Writes a CycloneDX 1.5 or SPDX 2.3 SBOM and a third-party notices file with every licence text (--notices). Prints Markdown for a PR comment, SARIF for code scanning or JUnit for your CI's test tab.
  • Checks only what a pull request changed with --diff main.
  • Runs offline with zero dependencies. Your code never leaves your machine.
sbom.cdx.json
{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "components": [
    { "type": "library",
      "name": "fancy-chart", "version": "1.4.2",
      "purl": "pkg:npm/fancy-chart@1.4.2",
      "licenses": [{ "license": { "id": "CC-BY-NC-4.0" } }] },
THIRD_PARTY_NOTICES.txt
THIRD-PARTY SOFTWARE NOTICES
Generated by licensegate 0.4.1 on 2026-10-21 from package-lock.json.
------------------------------------------------------------------------
express@4.21.2
License: MIT

(The MIT License)
Copyright (c) 2009-2014 TJ Holowaychuk
CI · release job
  BLOCK  some-db-driver@2.0.0  AGPL-3.0-only
  7 ok · 1 to review · 1 blocking
  SBOM → sbom.cdx.json
Error: Process completed with exit code 1.

Install and run

Nothing to install globally: npx downloads it, runs it and leaves your project untouched. Node.js 18 or newer.

npx -y https://licensegate.org/dl/licensegate.tgz --mode saas --prod

In any CI

GitHub Actions, GitLab, Bitbucket or any runner with Node:

- run: npm ci
- run: npx -y https://licensegate.org/dl/licensegate.tgz --mode saas --prod --sbom sbom.cdx.json

The command exits with code 1 when a dependency conflicts with your mode, so the job fails before the release.

On every pull request

--diff only looks at what the branch changed: packages that are new, or whose licence changed, since main. It reads the old lockfile with git show, so nothing is checked out and nothing goes over the network.

npx -y https://licensegate.org/dl/licensegate.tgz . --mode saas --prod --diff main --format markdown --output licences.md

Post licences.md as the PR comment. --format sarif puts the findings in GitHub or GitLab code scanning, --format junit in your CI's test tab and --format spdx writes an SPDX 2.3 SBOM.

Proof for a buyer or a client

The CLI stays free. When someone else has to trust the result, seal the report: a printable inventory with every flagged package explained, and an Ed25519 seal anyone can check against licensegate.org. Only two hashes and the counts leave your machine.

  • US$29One sealed report. No account, no subscription.
  • US$149 a yearAgency plan: unlimited sealed reports for 12 months. Doesn’t renew.
  • US$149, in 48 hDone-for-you review: a sealed report plus a plain-language memo for your buyer.

Buy a sealed report, US$29 Compare plansDone-for-you review

Guides