LicenseGuard

A tool that determines whether the licenses of your OSS dependencies create legal obligations for your distribution model.

Production: https://license-guard.rcc-aoki.workers.dev

What's different

Existing license compliance products fall into two camps: "deep analysis but requires a sales call (FOSSA / Black Duck)" or "self-serve but shallow analysis (Snyk)"—and no product exists at the intersection.

The core differentiator is the analysis layer. The same license can lead to completely opposite conclusions depending on context.

The last row is decisive. Most existing tools don't distinguish between dev and runtime dependencies, so they raise warnings that cry wolf and get ignored.

Related MCP server: DepGuard

Using it from an agent

The need for this product arises not when you're searching the browser, but when you're adding a dependency. So the primary placement isn't search results—it's the agent's toolset.

claude mcp add licenseguard --transport http https://license-guard.rcc-aoki.workers.dev/mcp

Stateless Streamable HTTP, no authentication required. Tools provided:

The JSON API returns the same analysis.

curl "https://license-guard.rcc-aoki.workers.dev/api/pkg/pypi/pyload-ng?model=saas"
# => {"license":"AGPL-3.0-only","verdict":"blocked", ...}

The agent-facing entry point is consolidated at /llms.txt.

Current phase

Phase 0 (validating willingness to pay) — MCP server and free web tool are published. Since the main battlefield is agent workflows rather than search, the validation metric isn't CTA click-through rate but MCP adoption and sustained call volume. The GitHub App (Phase 1) will be started after reviewing the validation results.

Supported ecosystems: npm / PyPI / Go modules / crates.io (Rust)

Passing a lock file lets you analyze transitive dependencies too (package-lock.json / pnpm-lock.yaml / yarn.lock). Of these, package-lock.json includes license information, so no external lookup is needed at all. Lock files include license information, so no external lookup is needed at all, and the exact versions actually installed can be used as-is. Problematic licenses are more likely to sneak in as dependencies of dependencies than as directly added dependencies, so this is the real main event.

curl -X POST https://license-guard.rcc-aoki.workers.dev/api/scan   -H 'content-type: application/json'   -d "$(jq -Rs '{content: ., distributionModel: "saas"}' package-lock.json)"

Development

npm install
npm test          # 全テスト
npm run typecheck
npm run smoke     # 実レジストリへの疎通確認
npm run e2e       # 本番に対する E2E 6種
                  #   ui          Playwright で実ブラウザ
                  #   a11y        アクセシビリティ
                  #   mcp         公式 MCP SDK クライアント
                  #   load        並列実行時の一貫性
                  #   adversarial 敵対的入力・境界値
                  #   correctness 既知の正解との突き合わせ
                  #   operational 経路間の一致・HTTP・キャッシュ
npm run dev       # http://localhost:8787

Even if all unit tests pass, some defects only surface when you run real data. smoke and e2e run against production-equivalent external dependencies, so be sure to run them before every release.

Deployment:

npm run db:migrate
npm run deploy

Documentation

• Design spec: docs/specs/2026-08-19-license-guard-design.md

• Phase 0 implementation plan: docs/superpowers/plans/2026-08-19-phase0-free-web-tool.md

Dependency OSS

Given the subject matter this product itself handles, all dependencies are limited to MIT / Apache-2.0 families. No disclosure obligation arises for our own SaaS.

Disclaimer

This tool presents information based on published license texts and dependency manifests—not legal advice. No attorney-client relationship is established by its use. The analysis is based on the license information declared in the manifest and does not cover all obligations or violations.