| name | license-compliance |
| description | Audits package dependency licenses using the Very Good CLI packages_check_licenses MCP tool. Flags non-compliant or unknown licenses and produces a compliance summary.
|
| when_to_use | Use when user says "check licenses", "license audit", "are our dependencies compliant", "check dependency licenses", "license compliance", "review package licenses", "scan for license issues", or "pre-release license check".
|
| argument-hint | [project-directory] |
| allowed-tools | Read Glob Grep mcp__very-good-cli__packages_check_licenses |
| model | sonnet |
| effort | medium |
License Compliance
Dependency license auditor for Dart and Flutter projects — verifies that all package dependencies use licenses compatible with the project's requirements using the Very Good CLI MCP tools.
Core Standards
Apply these standards to ALL license compliance work:
- Run
packages_check_licenses MCP tool on the target project directory with licenses: true to display full license information
- Pass
directory to the MCP tool when the project is not at the workspace root — monorepos with the project in a subdirectory (e.g. mobile/) require directory: 'mobile'
- A missing license is not "no license" — it means "all rights reserved" by default; always flag
- Transitive dependencies matter — a permissive package that depends on a GPL package still carries the GPL obligation
- Flag for manual review when in doubt — never assume compliance without a clear license identifier
License Categories
| Category | Licenses | Risk | Guidance |
|---|
| Permissive | MIT, BSD-2-Clause, BSD-3-Clause, Apache-2.0 | Low | Safe for any use |
| Weak copyleft | LGPL-2.1, LGPL-3.0, MPL-2.0 | Medium | Safe for dynamic linking; flag for static linking or modification |
| Strong copyleft | GPL-2.0, GPL-3.0, AGPL-3.0 | High | May require the entire project to adopt the same license |
| Unknown/Missing | None detected | High | Flag immediately for manual review |
Audit Process
1. Run License Check
Call the packages_check_licenses MCP tool on the target project directory. When the project lives in a subdirectory of the workspace (e.g. mobile/ in a monorepo), pass that path via the directory parameter.
2. Categorize Results
Classify each dependency license using the categories above. Pay attention to:
- Direct dependencies with strong copyleft licenses
- Transitive dependencies that introduce copyleft obligations
- Packages with no license or an unrecognized license identifier
3. Report Findings
Produce a structured compliance report:
## License Compliance Report
### Summary
- Total dependencies scanned: N
- Compliant: N
- Flagged: N
### Flagged Dependencies
| Package | License | Risk | Recommendation |
| --- | --- | --- | --- |
| package_name | GPL-3.0 | High | Replace or obtain exception |
### Compliant Dependencies
All other dependencies use permissive licenses (MIT, BSD, Apache 2.0).
### Recommendations
1. [Most urgent action]
2. [Next action]
