licsweep

Audits the licenses of your installed npm dependencies. It buckets every package by risk and can fail CI when a forbidden license shows up. One copyleft dependency can carry obligations you did not intend to take on, and this catches it before it ships. No dependencies, no AI.

Install

npm install -g @bobfromarcher/licsweep
# or once:
npx @bobfromarcher/licsweep

Usage

licsweep [path] [options]

| Option | Description | | --- | --- | | --check | Exit 1 if any dependency matches --deny | | --deny <list> | Comma-separated licenses or categories to forbid | | --flagged | Show only weak-copyleft, copyleft and unknown packages | | --markdown, --md | Markdown report | | --json | Raw JSON | | -h, --help | Show help | | -v, --version | Show version |

Examples

licsweep                          # summary of every dependency's license
licsweep --flagged                # only the ones worth a second look
licsweep --check --deny copyleft  # fail CI if any viral copyleft is present
licsweep --deny "GPL*,AGPL*"      # forbid specific SPDX ids (globs allowed)
licsweep --markdown > LICENSES.md

--deny accepts categories (permissive, weak-copyleft, copyleft, unknown) and license globs (GPL*, AGPL-3.0). With --check and no explicit list, it defaults to denying copyleft,unknown.

Gate it in CI

# .github/workflows/licenses.yml
- run: npx @bobfromarcher/licsweep --check --deny copyleft,unknown

Risk buckets

| Bucket | Examples | Meaning | | --- | --- | --- | | permissive | MIT, ISC, BSD, Apache-2.0, 0BSD, CC0 | Safe to ship in closed source | | weak-copyleft | LGPL, MPL-2.0, EPL, CDDL | File or library level obligations | | copyleft | GPL, AGPL, SSPL, OSL, EUPL | Viral, can require you to open-source | | unknown | missing or unrecognized | Investigate before shipping |

SPDX expressions like (GPL-3.0 OR MIT) are resolved to their most permissive option, which matches how you are actually allowed to use them.

Development

git clone https://github.com/bobfromarcher/licsweep
cd licsweep
node test/test.js

CI runs the suite on Node 18, 20 and 22 across Linux, macOS and Windows.

License

MIT, bobfromarcher.