license-compliance

name	license-compliance
description	Audits package dependency licenses using the Very Good CLI packages_check_licenses MCP tool. Flags non-compliant or unknown licenses and produces a compliance summary.
when_to_use	Use when user says "check licenses", "license audit", "are our dependencies compliant", "check dependency licenses", "license compliance", "review package licenses", "scan for license issues", or "pre-release license check". Use it especially when the request asks for a compliance verdict *without* a scan — "read the licenses off this pubspec", "confirm we're compliant", "just tell me if these packages are safe to ship", "I'd rather not run anything", "which of these are GPL" — because refusing to certify from a dependency list is the call this skill governs. A pasted pubspec is a trigger, not a substitute for the audit.
argument-hint	[project-directory]
allowed-tools	Read Glob Grep mcp__very-good-cli__packages_check_licenses
model	sonnet
effort	medium

License Compliance

Dependency license auditor for Dart and Flutter projects — verifies that all package dependencies use licenses compatible with the project's requirements using the Very Good CLI MCP tools.

---

Core Standards

Apply these standards to ALL license compliance work:

• Run packages_check_licenses MCP tool on the target project directory with licenses: true to display full license information
• Pass directory to the MCP tool when the project is not at the workspace root — monorepos with the project in a subdirectory (e.g. mobile/) require directory: 'mobile'
• A missing license is not "no license" — it means "all rights reserved" by default; always flag
• Transitive dependencies matter — a permissive package that depends on a GPL package still carries the GPL obligation
• Only scan output can certify compliance — never conclude that a project is compliant, clear, or safe to ship from a pubspec dependency list, a package name, a remembered license, or a previous audit. Scan output the user pastes or attaches counts as scan output: take it at face value, audit it, and do not re-run it or question its provenance. The distinction is whether each package arrives with a license attached, not who produced the text
• Flag for manual review when in doubt — never assume compliance without a clear license identifier
• Deliver the report in the prescribed format — when scan output exists, the answer is the template in Report Findings: the ## License Compliance Report heading, the summary counts including the total scanned, the flagged table with a risk level and a recommendation per row, and the ranked recommendations. A prose write-up or a bulleted list of packages is not the deliverable, however complete its content

---

License Categories

Category	Licenses	Risk	Guidance
Permissive	MIT, BSD-2-Clause, BSD-3-Clause, Apache-2.0	Low	Safe for any use
Weak copyleft	LGPL-2.1, LGPL-3.0, MPL-2.0	Medium	Safe for dynamic linking; flag for static linking or modification
Strong copyleft