Answers · npm licenses
How do I check the licenses of all my npm dependencies before shipping?
Last updated
TL;DR: Generate the full list of packages you ship, including transitive ones, group it by license, and look closely at anything copyleft (GPL, AGPL, LGPL), non-commercial, source-available, unknown or missing. npm 10 can write that list for you with npm sbom; each package's declared license is in its package.json. Permissive licenses (MIT, ISC, BSD, Apache-2.0) only ask you to keep their notices, while a package with no license grants you no permission at all.
What should I check, step by step?
1. Install from the lockfile (npm ci) so you check exactly what you ship.
- List production packages with their licenses: npm sbom --sbom-format spdx --omit dev > sbom.spdx.json (or npm ls --all --omit dev for the tree).
- Group by license and flag: GPL, AGPL and LGPL; CC BY-NC and other non-commercial terms; BUSL, Elastic and SSPL; UNLICENSED, "SEE LICENSE IN" and missing licenses.
- Read SPDX expressions carefully: "MIT OR Apache-2.0" lets you choose one; "MIT AND CC-BY-4.0" means both apply.
- Open the LICENSE file of every flagged package: declared metadata can be wrong or differ from the file.
- Check what your bundler actually pulls into the shipped output; a package listed as a dev dependency can still end up in it.
- Collect the notices permissive licenses require into a third-party notices file, and re-run the check in CI whenever the lockfile changes.
What do the license checks say?
Yes means the license grants the use, on the duties listed. Duties such as source_disclosure, share_alike and network_source_offer are the ones that conflict with keeping a product closed-source.
| Use | Answer | Why |
|---|---|---|
| An MIT package shipped in an app you sell (MIT) | Yes | Every use you described is granted by MIT, and nothing you described is prohibited. Duties: attribution, license_notice. |
| An LGPL-3.0 package shipped in an app you sell (LGPL-3.0-only) | Yes | Every use you described is granted by LGPL 3.0, and nothing you described is prohibited. Duties: attribution, license_notice, share_alike, source_disclosure. |
| A GPL-3.0 package, modified and shipped in an app you sell (GPL-3.0-only) | Yes | Every use you described is granted by GPL 3.0, and nothing you described is prohibited. Duties: attribution, license_notice, state_changes, share_alike, source_disclosure. |
How do I ask a2ally about this (free, no key)?
Add the MCP server https://www.a2ally.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “Is every npm package in this project OK for a commercial app?”
{
"tool": "check_rights_batch",
"arguments": {
"intended_use": {
"commercial_use": true,
"redistribution": true
},
"items": [
{
"ref": "react",
"license": "MIT"
},
{
"ref": "some-lgpl-lib",
"license": "LGPL-3.0-only"
}
]
}
}- No editor? Run curl -fsSL https://www.a2ally.com/check.mjs | node - in your project folder. It checks the direct dependencies in package.json and sends only license ids, never your code or file names.
- license_compatibility checks whether the licenses can be combined in one product and which duties apply together.
What are the sources?
Related
- How do I check the license of one npm or PyPI package?
- Can I use an npm package in a commercial product?
- MIT, GPL or AGPL code in a closed-source SaaS
Not legal advice. JSON · Markdown · All answers
Get a free API key in one call
No card and no email needed. 100 free credits; the license and policy checks stay free without a key.
curl -s -X POST https://www.a2ally.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export A2ALLY_API_KEY=rs_... # the api_key from the reply (shown once)
curl -s https://www.a2ally.com/v1/licenses/check -H "Authorization: Bearer $A2ALLY_API_KEY" \
-H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'