wip-license-hook

name	wip-license-hook
description	License rug-pull detection. Scans dependencies and forks for license changes, gates upstream merges, maintains a license ledger, and generates a public compliance dashboard.
license	MIT
interface	["cli","module","mcp"]
metadata	{"display-name":"License Rug-Pull Detection","version":"1.0.0","homepage":"https://github.com/wipcomputer/wip-ai-devops-toolbox","author":"Parker Todd Brooks","category":"dev-tools","capabilities":["license-scanning","rug-pull-detection","compliance-gating","license-ledger"],"requires":{"bins":["node","git","npm"]},"openclaw":{"requires":{"bins":["node","git","npm"]},"install":[{"id":"node","kind":"node","package":"@wipcomputer/wip-license-hook","bins":["wip-license-hook"],"label":"Install via npm"}],"emoji":"🛡️"}}
compatibility	Requires git, npm, node. Node.js 18+.

wip-license-hook

Detect license rug-pulls before they reach your codebase.

Commands

Initialize ledger for a project

wip-license-hook init --repo /path/to/repo

Scans all current dependencies and forks, records their licenses, creates LICENSE-LEDGER.json.

Scan all dependencies

wip-license-hook scan --all

Checks every dependency and fork against the ledger. Updates last_checked. Flags any changes.

Pre-merge gate

wip-license-hook gate --upstream <remote>

Fetches upstream without merging. Checks license. Returns exit code 0 (safe) or 1 (changed/blocked).

Use in git hooks or CI.

Generate report

wip-license-hook report

Outputs a human-readable license health report.

Generate dashboard

wip-license-hook dashboard --output ./docs

Creates a static HTML dashboard from the ledger. Deploy to GitHub Pages.

Daily Cron Usage

Add to HEARTBEAT.md or as a cron job:

wip-license-hook scan --all --alert

If any license changed, sends alert via configured channel (email, iMessage, Discord).

What It Detects

• LICENSE file content changes
• package.json license field changes
• SPDX header changes
• License removal (file deleted)
• License downgrade (permissive → restrictive)

What It Does NOT Do

• It does not legal advice make
• It does not auto-merge anything ever
• It does not modify upstream code

Alert Levels

• 🟢 Clean — license unchanged since adoption
• 🟡 Warning — license metadata inconsistency (e.g., LICENSE file says MIT but package.json says ISC)
• 🔴 Blocked — license changed from what was adopted. Merge blocked. Human review required.

MCP

Tools: license_scan, license_audit, license_gate, license_ledger

Add to .mcp.json:

{
  "wip-license-hook": {
    "command": "node",
    "args": ["/path/to/tools/wip-license-hook/mcp-server.mjs"]
  }
}